Printable View
Does anyone have experience scanning hosts running iptables firewalls running tarpits.
I have come up against a few recently with nmap and i'm wondering whats the best away around them.
Anyone know of any specific options I can specifiy through nmap to help avoid these ports
I thought about just specifying know ports for my scans but that means I would miss any other servers running on non standard ports
Any help would be great
Memnoch
Interesting... A "few".... I dunno, but I wasn't under the impression that the net is littered with these things. That being the case I would suspect foul play in the form of a honeynet.Quote:
I have come up against a few recently with nmap and i'm wondering whats the best away around them.
What evidence do you have to support your theory that you are being tarpitted?
Hehehe sorry I will be more specific, by a few I don't mean I have been randomly scanning subnets attempting to find some tarpits.
Basically a friend of mine works for an it company and they have deployed tarpits to some of their clients who are using linux firewalls (instead of cisco pix's or the like).
After talking with the customers we decided it would be good to test these systems and find any problems now before their deployed.
After scanning them I have read up on the technology and setup a system on my local network with a tarpit to test with.
Honeypots wouldn't throw off the same results, they are just there pretending to be other machines and services to trap hackers, where as tarpits are ports which will allow a few packets through the firewall to act like a service is running on that port then drop the window size on the pack to zero effectively forcing that connection open.
Memnoch
I'm well aware of what a tarpit is... ;)
I take it then that you have witnessed the "closing of the window"?
A sophisticated honeynet could quite easily contain tarpits though since you know what it is you are looking at then clearly it isn't one.
What NMAP switches have you used to date?