From: waltdnes@waltdnes.org
To: Netfilter list <netfilter@lists.netfilter.org>
Subject: T-Pot (TCP HoneyPot) idea
Date: Thu, 10 Apr 2003 18:07:41 -0400 [thread overview]
Message-ID: <20030410220741.GA32442@m1800> (raw)
I'm sure every here has seens lots of SYN-packets in their logs,
trying to connect to various ports they shouldn't be talking to. I
don't run any public servers, and I use passive ftp, so I simply block
all connection attempts. The general procedure is to drop the packet,
and ignore it. What would be the effect of sending back a SYN-ACK
packet (and anything else necessary?) to fake the setting up of a
connection... and then dropping the packet and ignoring it ?
Would an infected machine scanning the net eventually run into
resource limits and DOS itself ? I'm sure that professional crackers
can work around this, but if we can make things a bit more painful for
skiddies and automatic worms, then let's do it.
Can such trickery be pulled off with a current bog-standard iptables,
or does someone need to write a new "target"?
--
Walter Dnes <waltdnes@waltdnes.org>
An infinite number of monkeys pounding away on keyboards will
eventually produce a report showing that Windows is more secure,
and has a lower TCO, than linux.
next reply other threads:[~2003-04-10 22:07 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-04-10 22:07 waltdnes [this message]
2003-04-10 22:20 ` T-Pot (TCP HoneyPot) idea Bob Keyes
2003-04-10 22:36 ` Michael H. Warfield
2003-04-11 2:51 ` Matt Hellman
2003-04-11 4:46 ` Bob Keyes
2003-04-11 21:17 ` Matt Hellman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030410220741.GA32442@m1800 \
--to=waltdnes@waltdnes.org \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.