Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a new server running CentOS 5.3 with iptables v1.3.5. I'm not familiar with iptables and trying to setting up the "Tarpit" technique in iptables, but so far this is what I got:

iptables -A INPUT -s x.x.x.x -p tcp -j TARPIT

I really have no idea about the command. Do I need to modify some part of the command?

share|improve this question
add comment

1 Answer 1

the TARPIT target is part of xtables_addons and only usable for TCP connections; providing your system actually has the xtables_addons targets, you can use this target as a way of "harassing" any would-be attackers since sending them to the TARPIT will cause their scanning script to think that the TCP session is alive; simply using DROP can be avoided by the attacker simply by using a short connection timeout.

So, if you're running any iptables rules for tcp connections that you would normally DROP - consider TARPIT instead; additionally, if you are also using connection tracking but unconditionally TARPIT-ing a port, add a NOTRACK rule to your raw table for that port to avoid consuming conntrack resources.

share|improve this answer
    
do have any good references about adding NOTRACK and raw table? –  CrackerJack9 Dec 21 '11 at 0:32
    
both can be compiled into the kernel, or as modules, beyond that, I don't know what it is you're asking. –  Olipro Dec 23 '11 at 20:37
    
@Olipro: do you have an idea as to whether similar behavior (i.e. sending ACK and then not doing anything) can be achieved some other way with the vanilla modules usable in iptables? –  0xC0000022L Jun 12 at 19:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.