Setting up “Tarpit” technique in iptables

Question

I have new server running CentOS 5.3 with iptables v1.3.5

Im not familiar with iptables.

Im trying to setting up "Tarpit" technique in iptables by searching it, but so far this is what I got:
iptables -A INPUT -s x.x.x.x -p tcp -j TARPIT

I really no idea about the command. Do I need to modify some part of the command?

Thanks in advance

Answer 1

ok first off here is a good article on tarpits

http://www.securityfocus.com/infocus/1723

All the command above says is, any thing from ip address x.x.x.x protocol tcp send to the tarpit.

read the article in the link and I think you will get what you want.

J

Answer 2

the TARPIT target is part of xtables_addons and only usable for TCP connections; providing your system actually has the xtables_addons targets, you can use this target as a way of "harassing" any would-be attackers since sending them to the TARPIT will cause their scanning script to think that the TCP session is alive; simply using DROP can be avoided by the attacker simply by using a short connection timeout.

So, if you're running any iptables rules for tcp connections that you would normally DROP - consider TARPIT instead; additionally, if you are also using connection tracking but unconditionally TARPIT-ing a port, add a NOTRACK rule to your raw table for that port to avoid consuming conntrack resources.