the Scanner Tarpit HOWTO

John D. Hardin <jhardin@impsec.org>

1. Introduction

• 1.1 Introduction
• 1.2 Audience
• 1.3 Tools
• 1.4 Feedback, Credits & Resources
• 1.5 Copyright & Disclaimer

2. Background Knowledge

• 2.1 What is a firewall?
• 2.2 What is a Boundary Network or DMZ?
• 2.3 What is a firewall script?
• 2.4 What is a tarpit?
• 2.5 What is Transparent Proxy?

3. Planning

• 3.1 Traffic that is always hostile
• 3.2 Traffic to nonexistent hosts

4. Detecting and blocking scans of the boundary network

• 4.1 Configuring Portsentry
• 4.2 The i-i-blk and o-i-blk firewall chains

5. Tarpitting the scanner or worm

• 5.1 Running LaBrea on the outer firewall

6. Reporting scanning activity

• 6.1 LogCheck - notify yourself
• 6.2 DShield - notify the ISP and others
• 6.3 MRTG - graph the activity

7. Protecting individual computers

8. Possible extensions

• 8.1 Spam control