/usr/src/xtables-addons-1.40/xt_TARPIT.Kconfig is in xtables-addons-dkms 1.40-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 | config NETFILTER_XT_TARGET_TARPIT
tristate '"TARPIT" target support'
depends on NETFILTER_XTABLES
---help---
Adds a TARPIT target to iptables, which captures and holds incoming TCP
connections using no local per-connection resources. Connections are
accepted, but immediately switched to the persist state (0 byte
window), in which the remote side stops sending data and asks to
continue every 60-240 seconds. Attempts to close the connection are
ignored, forcing the remote side to time out the connection in 12-24
minutes.
This offers similar functionality to LaBrea
<http://www.hackbusters.net/LaBrea/>, but does not require dedicated
hardware or IPs. Any TCP port that you would normally DROP or REJECT
can instead become a tar pit or honeypot. All 3 modes may be used
in iptables rules interchangably and simultaneously.
A honeypot option is available which will answer connections normally
and allow the remote to send data packets that may be captured in a
pcap for later analysis. A reset mode is also available that will only
send an inline reset (RST).
|