Nmap Development: Re: [patch] detection of tarpitted ports

[Ron <iago () valhallalegends com>]

Some firewills and software will respond using tricks like a 0 window 
size to trick portscanners into waiting for a really long time without 
learning anything useful.  They're called tarpits becuase they slow the 
hell out of a scan.  I'd recommend googling it.
Alex R wrote:

> What are tarpitted ports?
>
>  
>
> > -----Original Message-----
> > From: Martin Mačok [mailto:martin.macok () underground cz]
> > Sent: Monday, January 03, 2005 6:56 PM
> > To: nmap-dev () insecure org
> > Subject: [patch] detection of tarpitted ports
> >
> > I have implemented detection for tarpitted ports for SYN, ACK and
> > Window scans. I was testing it against iptables TARPIT. SYN scan
> > should detect Labrea tarpit too but I'm not sure how Labrea tarpit
> > responds to Window or ACK scan (and I'm too lazy to check the code
> > or test it ;-)). Anybody?
> >
> > http://Xtrmntr.org/ORBman/tmp/nmap/nmap-3.78-detect_TARPIT.patch
> >
> > Martin Mačok
> > IT Security Consultant
> >
> > ---------------------------------------------------------------------
> > For help using this (nmap-dev) mailing list, send a blank email to
> > nmap-dev-help () insecure org . List archive: http://seclists.org
> >
> >
> >    
>
>
> ---------------------------------------------------------------------
> For help using this (nmap-dev) mailing list, send a blank email to 
> nmap-dev-help () insecure org . List archive: http://seclists.org
>
>
>
>  
---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org