[wplug] Re: howto advertise all ports as open

M. Sussman msussman at na-net.ornl.gov
Thu Apr 3 19:28:46 EST 2003


In addition to using something like portsentry to monitor all ports or
a honeypot, there is something called LaBrea.  This one responds
to all incoming packets with the IP equivalent of "I'm busy, wait
a minute and I'll get to you" and then repeats this busy message
just often enough that nothing times out.  If you connect to it
using a browser, it will hang forever and never get any information.

You can run it
on a firewall machine, if you want.  It is designed to listen on a
"spare" IP address, but  it can be used on otherwise 
unused ports.

http://www.hackbusters.net/LaBrea/

-- 
M. Sussman
msussman at na-net.ornl.gov



More information about the wplug mailing list