TARPIT target is part of xtables_addons and only usable for TCP connections; providing your system actually has the xtables_addons targets, you can use this target as a way of "harassing" any would-be attackers since sending them to the
TARPIT will cause their scanning script to think that the TCP session is alive; simply using
DROP can be avoided by the attacker simply by using a short connection timeout.
So, if you're running any iptables rules for tcp connections that you would normally
DROP - consider
TARPIT instead; additionally, if you are also using connection tracking but unconditionally
TARPIT-ing a port, add a
NOTRACK rule to your
raw table for that port to avoid consuming conntrack resources.