path: root/extensions/
diff options
Diffstat (limited to 'extensions/')
1 files changed, 0 insertions, 34 deletions
diff --git a/extensions/ b/extensions/
deleted file mode 100644
index 26526b76..00000000
--- a/extensions/
+++ /dev/null
@@ -1,34 +0,0 @@
-Captures and holds incoming TCP connections using no local
-per-connection resources. Connections are accepted, but immediately
-switched to the persist state (0 byte window), in which the remote
-side stops sending data and asks to continue every 60-240 seconds.
-Attempts to close the connection are ignored, forcing the remote side
-to time out the connection in 12-24 minutes.
-This offers similar functionality to LaBrea
-<> but doesn't require dedicated
-hardware or IPs. Any TCP port that you would normally DROP or REJECT
-can instead become a tarpit.
-To tarpit connections to TCP port 80 destined for the current machine:
-iptables -A INPUT -p tcp -m tcp --dport 80 -j TARPIT
-To significantly slow down Code Red/Nimda-style scans of unused address
-space, forward unused ip addresses to a Linux box not acting as a router
-(e.g. "ip route" on a Cisco), enable IP
-forwarding on the Linux box, and add:
-iptables -A FORWARD -p tcp -j TARPIT
-iptables -A FORWARD -j DROP
-If you use the conntrack module while you are using TARPIT, you should
-also use the NOTRACK target, or the kernel will unnecessarily allocate
-resources for each TARPITted connection. To TARPIT incoming
-connections to the standard IRC port while using conntrack, you could:
-iptables -t raw -A PREROUTING -p tcp --dport 6667 -j NOTRACK
-iptables -A INPUT -p tcp --dport 6667 -j TARPIT