Assuming that a host does not require a Telnet service running in it, is it possible to create a fake telenet process that listens to the Telnet port and blocks all IP that tries to make a connection (TCP-SYN) with it ?? The attacker when tries to scan this host using nmap, it makes send a TCP-SYN t o telnet port (not in all cases) , the host can now get the source IP and b locks all connection from that IP. Will this defense concept work ???
Defense against nmap tcp synchronise scans
Jul 23, 2013
2 Replies
iptables -A -p tcp --dport 23 -j REJECT is one solution.
Doesn't make sense at all and is no defense concept.
cheers
Google for portsentry. It's an ancient script/tool that does this.
Best regards Thomas
Join the Discussion
Have something to add? Share your thoughts — no account required.
Didn't find your answer?
Ask the community — no account required