3 ms·

Back in 2007 I came up with something similar. It opened a bunch of decoy ports that changed frequently so that a scanner would quickly get blocked. http://shi

• ryanlol 10y ago
  You could presumably still just SYN scan to find the ports and then use proxies to identify the real sshd. Obviously my approach would be somewhat involved but I'd imagine this would mostly be intended to protect against someone who may already have likely password candidates, rather than just random scanners.
  • jgrahamc 10y ago
    The idea was that if you sent a packet to a decoy port then your IP was banned.
    • ryanlol 10y ago
      I don't think shimmer will catch half open connections, and if it did you could somewhat easily get large parts of the internet banned.
      • jgrahamc 10y ago
        Maybe not. It's been 8 years since I last looked at that code...
• spc476 10y ago
  About a decade ago I worked at a small web-hosting company where I installed the LaBrea tarpit software (http://labrea.sourceforge.net/Intro-History.html http://labrea.sourceforge.net/Intro-History.html) on an otherwise unused system and had our routers route all non-allocated IPs to said system. The intent was to use that to track IPs that were attacking (since otherwise, no legitimate traffic would hit that server) and then block them at the router level. Sadly, source level routing on routers is slow, and even if it wasn't, I wasn't sure how to automatically block said IPs at the router level.