They do not appear to be ramping up on any of my VPS nodes. I see the same averages to my tarpit ports on all my nodes. # VPS They all look similar to thi

They do not appear to be ramping up on any of my VPS nodes. I see the same averages to my tarpit ports on all my nodes. # VPS They all look similar to this iptables -L INPUT -n -v | grep TAR | sort -r | awk '{print $1"\t" $3"\t" $11}' 2680 TARPIT dpt:23 2657 TARPIT dpt:6379 170K TARPIT dpt:445 1186 TARPIT dpt:80 882 TARPIT dpt:22 757 TARPIT dpt:443 591 TARPIT dpt:5900 311 TARPIT dpt:21 296 TARPIT dpt:3389 119 TARPIT dpt:873 Some poorly coded bots appear to get stuck on 445 indefinitely. On the other hand I do see a vast increase on my home network to 5900 VNC. It is usually about double the hits to 3389 RDP # Home iptables -L INPUT -n -v | grep TAR | sort -r | awk '{print $1"\t" $3"\t" $11}' 9013 TARPIT dpt:5900 1628 TARPIT dpt:22 1274 TARPIT dpt:23 1092 TARPIT dpt:445 119 TARPIT dpt:3389 40 TARPIT dpt:21 [Edit] Here is a second home connection that has a higher uptime. Running tcpdump it looks like the latest VNC bots do not recognize and avoid tarpits. # Second Home connection iptables -L INPUT -n -v | grep TAR | sort -r | awk '{print $1"\t" $3"\t" $11}' 50532 TARPIT dpt:22 44301 TARPIT dpt:445 33520 TARPIT dpt:23 6718 TARPIT dpt:80 6439 TARPIT dpt:3389 184K TARPIT dpt:5900 1091 TARPIT dpt:21 271 TARPIT dpt:1900