Skip to contentSkip to conversation

tarpit before or after adding chain?

DISCUSSION Eric 4 participants 4 messages Dec 17, 2005 – Jan 3, 2006

lore
Share & tools
lore

Eric

author
#0 lore raw

I'm a little confused about when to add the TARPIT trap.

iptables -N SPECIAL # add special chain for tarpit usage

*HERE*?
iptables -A SPECIAL -p tcp -j TARPIT

#

# the following string match rules screen out nimda and other crap
#
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm --string "/default.ida?"     -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm --string ".exe?/c+dir"       -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm --string ".exe?/c+tftp"      -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm --string "cmd.exe"           -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm --string "vti_bin"           -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm --string "nsiislog.dll"      -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm --string "click-network.com" -j SPECIAL

*OR HERE?*
iptables -A SPECIAL -p tcp -j TARPIT

Thanks
Eric

#1 lore raw
Quoted 25 lines · Eric

I'm a little confused about when to add the TARPIT trap.

iptables -N SPECIAL # add special chain for tarpit usage

*HERE*?
iptables -A SPECIAL -p tcp -j TARPIT

#

# the following string match rules screen out nimda and other crap
#
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string "/default.ida?"     -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string ".exe?/c+dir"       -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string ".exe?/c+tftp"      -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string "cmd.exe"           -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string "vti_bin"           -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string "nsiislog.dll"      -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string "click-network.com" -j SPECIAL
Quoted 7 lines

*OR HERE?*
iptables -A SPECIAL -p tcp -j TARPIT

Thanks
Eric

And again ... why do you need all this, when you're running linux and those are no harm in any way to your system? Or you are with those guys trying to complex their lifes every single day?

#2 lore raw
Quoted 27 lines
Quoted 27 lines

I'm a little confused about when to add the TARPIT trap.

iptables -N SPECIAL # add special chain for tarpit usage

*HERE*?
iptables -A SPECIAL -p tcp -j TARPIT

#

# the following string match rules screen out nimda and other crap
#
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string "/default.ida?"     -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string ".exe?/c+dir"       -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string ".exe?/c+tftp"      -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string "cmd.exe"           -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string "vti_bin"           -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string "nsiislog.dll"      -j SPECIAL
iptables -A INPUT -i eth0 -p tcp  --dport 80 -m string --algo bm 
--string "click-network.com" -j SPECIAL
Quoted 3 lines
Quoted 3 lines

*OR HERE?*
iptables -A SPECIAL -p tcp -j TARPIT

Im looking at all these string rules and trying to imagine how your
CPU usage will get high, as it seems you have a not-very-low traffic network ...... nobody with a /21 network will have low traffic, specially tcp/80 traffic !!!!

I havent used string for a while now. In fact i have never used it
since I moved to 2.6 kernel. I know it has been ported recently, but I have never used it yet. But I remember ... it's not that long ago ...... the 2.4 kernel time ....... all the headaches of CPU usage getting at astronomic levels because of 20-30 string rules on a busy network ..... i will never forget that ... :)

Take it easy with string module, that's my advice ....

Signature · 8 lines
	Atenciosamente / Sincerily,
	Leonardo Rodrigues
	Solutti Tecnologia
	http://www.solutti.com.br

	Minha armadilha de SPAM, NÃO mandem email
	[email protected]
	My SPAMTRAP, do not email it
#3 lore raw
In reply to Georgi Alexandrov
Quoted 5 lines
Quoted 2 lines

iptables -A INPUT -i eth0 -p tcp --dport 80 -m string --algo bm --string
"/default.ida?" -j SPECIAL

And again ... why do you need all this, when you're running linux and those are no harm in any way to your system?
Or you are with those guys trying to complex their lifes every single day?

Yes, that's what TARPIT was invented for.

Jan Engelhardt