There are many scripts out there, especially on Mikrotik, which list drop as the action for denying bad guy traffic. While this isn’t wrong, you could put the tarpit action to better use for actions which are dropping attacking type of traffic.
So what is Tarpit?
Tarpit is fairly simple. When connections come in and are “tarpitted” they don’t go back out. The connection is accepted, but when data transfer begins to happen, the TCP window size is set to zero. This means no data can be transferred during the session. The session is held open, and requests from the sender (aka attacker) to close the session are ignored. They must wait for the connection to timeout.
So what’s the downside?
TCP is not really designed to hold onto a connection. It can be additional overhead on a taxed system. Most modern firewalls can handle tarpitting without an issue. However, if you get thousands of connections it can overwhelm a system or a particular protocol.
How can I use it?
If you have scripts, such as the SSH drop off the Mikrotik wiki, simply change the action to “tarpit” instead of “drop”.
