3 ms·

Why wouldn't someone just set a timeout on individual port scans such that long responders were pruned from the search? Seems like this behavior is extremely re

• BLKNSLVR 2y ago
  I think the time difference in scans is not that each individual scan takes longer, it's that there are a lot more scans to be performed. It's somewhat of a DoS for a network scanner overall, rather than a DoS for each individual network scan action (as per a traditional tarpit).
  • ternnoburn 2y ago
    > When scanners attempt to identify open TCP ports by sending SYN packets, our solution introduces a second layer of disruption. It delays SYN-ACK responses, sending them after a set time. While the delay for a single port may seem minor, the impact compounds when attackers scan thousands of ports across a network teeming with virtual devices.