I’ve read an article which describes how to simulate the close ports as open in Linux by eBPF. That is, an outside port scanner, malicious actor, will get tricked to observe that some ports, or all of them, are open, whereas in reality they’ll be closed.
How could this be useful for the owner of a server? Wouldn’t it be better to pretend otherwise: open port -> closed?
pseudo honeypot ip blocker. you could auto drop traffic from people sniffin where/when they should not be
Would it even need to pretend it is open? If it can fake a port being open then it can tell when a close port is being pinged. So can outright block connections from those IPs without ever pretending it is open?
sure, if you want to be that black and white about it… but with this you maybe could glean more information about the attempt and have more granular logic.
What extra information could you gather? Note I assume we are talking about a fake open port here, not an active service listening on a port that can communicate with the attacker. That could be done without eBPF though - so what advantage would eBPF have here?
And I assume this is more on the level of responding to pings than creating full connections? At which point you are only dealing with a single packet from the sender. So what value does responding give you here?
Presumably, OP doesn’t know the concept of a honeypot, so: https://en.wikipedia.org/wiki/Honeypot_(computing)
Basically, it’s a decoy system, which an attacker will likely target.
