Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a new server running CentOS 5.3 with iptables v1.3.5. I'm not familiar with iptables and trying to setting up the "Tarpit" technique in iptables, but so far this is what I got:

iptables -A INPUT -s x.x.x.x -p tcp -j TARPIT

I really have no idea about the command. Do I need to modify some part of the command?

share|improve this question

the TARPIT target is part of xtables_addons and only usable for TCP connections; providing your system actually has the xtables_addons targets, you can use this target as a way of "harassing" any would-be attackers since sending them to the TARPIT will cause their scanning script to think that the TCP session is alive; simply using DROP can be avoided by the attacker simply by using a short connection timeout.

So, if you're running any iptables rules for tcp connections that you would normally DROP - consider TARPIT instead; additionally, if you are also using connection tracking but unconditionally TARPIT-ing a port, add a NOTRACK rule to your raw table for that port to avoid consuming conntrack resources.

share|improve this answer
do have any good references about adding NOTRACK and raw table? – CrackerJack9 Dec 21 '11 at 0:32
both can be compiled into the kernel, or as modules, beyond that, I don't know what it is you're asking. – Olipro Dec 23 '11 at 20:37
@Olipro: do you have an idea as to whether similar behavior (i.e. sending ACK and then not doing anything) can be achieved some other way with the vanilla modules usable in iptables? – 0xC0000022L Jun 12 '14 at 19:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.