Hacker News new | ask | show | jobs
by blastbeat 2649 days ago
Assuming you run a legit SSH server on port A and an SSH tarpit on port B. What hinders an attacker to connect to port A an B at the same time? What is the advantage having an attacker connected for weeks on port B?
2 comments

They will usually try port 22 for SSH, only. So, if tarpit is on port 22 and real SSH is on another - mission accomplished: you're making them (at least one of their threads) wait.
nothing, except the attacker doesn't know what A is. 22 is the default for ssh.