TARPIT target

TARPIT target

[bmcdowell]

I apologize in advance if this has already been addressed, but I can't seem to find the answer anywhere.  Yes, I looked in the docs and yes, I looked in the mailing list archive.  The latter was a tad difficult to search, though, as I had to try and parse that 84 MB file...  At any rate, here's my question:

How do I use the TARPIT target?

I have iptables 1.2.8 installed and working otherwise.  I'm running RedHat 9.

When I try and use
	'iptables -A FORWARD -j TARPIT'
I get
	'iptables: No chain/target/match by that name'

I have rebuilt the kernel, but I do not see an option for 'TARPIT' anywhere in the netfilter stuff.  Yes, I do have 'experimental' turned on.  I have also deleted iptables completely and used only the source to install it.

Any ideas?


Thanks,

Bob McDowell
IS Specialist
Cox HealthPlans, LLC
417.269.2848

Confidentiality Notice: This e-mail message (including any attachments) may contain confidential and privileged information, and is for the sole use of the intended recipient(s). Any unauthorized review, use, disclosure or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender by replying to this e-mail message, permanently deleting the original message and destroying any hard copies of the original message that may have been created.

Re: TARPIT target

[Cedric Blancher]

Le ven 26/09/2003 à 22:45, bmcdowell@coxhealthplans.com a écrit :
> How do I use the TARPIT target?
> I have iptables 1.2.8 installed and working otherwise.  I'm running RedHat 9.
> When I try and use
> 	'iptables -A FORWARD -j TARPIT'
> I get
> 	'iptables: No chain/target/match by that name'

Your kernel does not support TARPIT.

> I have rebuilt the kernel, but I do not see an option for 'TARPIT'
> anywhere in the netfilter stuff.  Yes, I do have 'experimental' turned
> on.  I have also deleted iptables completely and used only the source
> to install it.

TARPIT target is in patch-o-matic (extra section). So you have to
download and install it.

	1. install patch-o-matic (see README)
	2. rebuild your kernel from sources that got patched
	3. build iptables

And it should work.

Not that TARPIT only applies to TCP connections. So your previously
given command won't work :

	cbr@elendil:~$ sudo iptables -A FORWARD -j TARPIT
	iptables: Invalid argument

You have to specify TCP matching :

	cbr@elendil:~$ sudo iptables -A FORWARD -p tcp -j TARPIT
	cbr@elendil:~$ sudo iptables -L FORWARD
	Chain FORWARD (policy ACCEPT)
	target     prot opt source               destination
	TARPIT     tcp  --  anywhere             anywhere

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE

RE: TARPIT target

[bmcdowell]

Well, I've gotten mixed results.  I did get the TARPIT target to work, but cannot for the life of me get 'nth' to work also.  It shows up as an option in the kernel config, but the libipt_nth.so is never created.  I can see a libipt_nth.h in the source, but that's as close as it gets.

One thing that gives me pause is that I am using 1.2.8, and not 1.2.7a.  There are two reasons why I think this may be important.  First, the pom is older than the iptables version I am using.  Second, libipt_TARPIT.c and libipt_TARPIT.d are both found in the source for iptables 1.2.8.  Does this not mean that TARPIT is included at least as an option in 1.2.8?  Of course, if it is, I can't seem to get it to show up in the kernel menu...

Please forgive any ignorance on my part...

Thanks,

Bob

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Cedric Blancher
Sent: Friday, September 26, 2003 4:32 PM
To: Bob McDowell
Cc: netfilter@lists.netfilter.org
Subject: Re: TARPIT target


Le ven 26/09/2003 à 22:45, bmcdowell@coxhealthplans.com a écrit :
> How do I use the TARPIT target?
> I have iptables 1.2.8 installed and working otherwise.  I'm running RedHat 9.
> When I try and use
> 	'iptables -A FORWARD -j TARPIT'
> I get
> 	'iptables: No chain/target/match by that name'

Your kernel does not support TARPIT.

> I have rebuilt the kernel, but I do not see an option for 'TARPIT'
> anywhere in the netfilter stuff.  Yes, I do have 'experimental' turned
> on.  I have also deleted iptables completely and used only the source
> to install it.

TARPIT target is in patch-o-matic (extra section). So you have to
download and install it.

	1. install patch-o-matic (see README)
	2. rebuild your kernel from sources that got patched
	3. build iptables

And it should work.

Not that TARPIT only applies to TCP connections. So your previously
given command won't work :

	cbr@elendil:~$ sudo iptables -A FORWARD -j TARPIT
	iptables: Invalid argument

You have to specify TCP matching :

	cbr@elendil:~$ sudo iptables -A FORWARD -p tcp -j TARPIT
	cbr@elendil:~$ sudo iptables -L FORWARD
	Chain FORWARD (policy ACCEPT)
	target     prot opt source               destination
	TARPIT     tcp  --  anywhere             anywhere

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE

RE: TARPIT target

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 2982 bytes --]

On Tue, 2003-09-30 at 15:58, bmcdowell@coxhealthplans.com wrote:
> Well, I've gotten mixed results.  I did get the TARPIT target to work, but cannot for the life of me get 'nth' to work also.  It shows up as an option in the kernel config, but the libipt_nth.so is never created.  I can see a libipt_nth.h in the source, but that's as close as it gets.
> 
For the libraries to be created, you have to recompile the iptables
userspace proggies.

> One thing that gives me pause is that I am using 1.2.8, and not 1.2.7a.  There are two reasons why I think this may be important.  First, the pom is older than the iptables version I am using.  Second, libipt_TARPIT.c and libipt_TARPIT.d are both found in the source for iptables 1.2.8.  Does this not mean that TARPIT is included at least as an option in 1.2.8?  Of course, if it is, I can't seem to get it to show up in the kernel menu...
> 
As above, you need to recompile the iptables source and spcify your
kernel dir as per the INSTALL doc.

> Please forgive any ignorance on my part...
> 
> Thanks,
> 
> Bob
> 
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Cedric Blancher
> Sent: Friday, September 26, 2003 4:32 PM
> To: Bob McDowell
> Cc: netfilter@lists.netfilter.org
> Subject: Re: TARPIT target
> 
> 
> Le ven 26/09/2003 à 22:45, bmcdowell@coxhealthplans.com a écrit :
> > How do I use the TARPIT target?
> > I have iptables 1.2.8 installed and working otherwise.  I'm running RedHat 9.
> > When I try and use
> > 	'iptables -A FORWARD -j TARPIT'
> > I get
> > 	'iptables: No chain/target/match by that name'
> 
> Your kernel does not support TARPIT.
> 
> > I have rebuilt the kernel, but I do not see an option for 'TARPIT'
> > anywhere in the netfilter stuff.  Yes, I do have 'experimental' turned
> > on.  I have also deleted iptables completely and used only the source
> > to install it.
> 
> TARPIT target is in patch-o-matic (extra section). So you have to
> download and install it.
> 
> 	1. install patch-o-matic (see README)
> 	2. rebuild your kernel from sources that got patched
> 	3. build iptables
> 
> And it should work.
> 
> Not that TARPIT only applies to TCP connections. So your previously
> given command won't work :
> 
> 	cbr@elendil:~$ sudo iptables -A FORWARD -j TARPIT
> 	iptables: Invalid argument
> 
> You have to specify TCP matching :
> 
> 	cbr@elendil:~$ sudo iptables -A FORWARD -p tcp -j TARPIT
> 	cbr@elendil:~$ sudo iptables -L FORWARD
> 	Chain FORWARD (policy ACCEPT)
> 	target     prot opt source               destination
> 	TARPIT     tcp  --  anywhere             anywhere
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

TARPIT target

[Innocent Evil]

When is TARPIT target coming with stable iptable?




--
You don't have any choice, you already made it before you came here.