🕸️ Dynamic Protocol Tarpit

Infinite TCP handshakes to trap scanners.

→ Explore in ATT&CK matrix (7 mappings) Deployment detail

What it is

A tarpit that answers for unused addresses and holds connections open, or keeps protocol sessions busy without ever completing them. Scanners and worms get stuck, which slows them down and identifies them. Nothing legitimate talks to those addresses, so every source logged is a scanner to investigate.

Implementation requirements

Run a tarpit on unused addresses: LaBrea-style (answer for unused IPs, complete the TCP handshake, then hold the connection with a tiny window) or a protocol-level tarpit such as an endless SSH banner
Use only address space you own and that nothing else will be assigned: reserve it in IPAM and exclude it from DHCP scopes
Monitoring: the tarpit logs every connection (source, port, duration). Nothing legitimate talks to those addresses, so each source is an internal scanner to investigate
Safety: allow-list your own vulnerability scanners and monitoring, cap concurrent held connections, and make sure the tarpit cannot answer for addresses in use
Placement: one tarpit per segment you want covered, because ARP-based answering does not cross routed boundaries
Rollback: Stop the tarpit. Release the address range in IPAM only after confirming nothing still depends on it.
Upkeep: Review the allow-list when scanners change. Monthly proof-of-life connection from a test host.

Technologies

Network

ATT&CK coverage 7

Technique	Tactic	Status	Confidence	Tier
T1095 Non-Application Layer Protocol	Command & Control	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1095 Non-Application Layer Protocol as an adversary behaviour. The attacker's own C2 never reaches a tarpit unless they are already inside a honey network.
T1572 Protocol Tunneling	Command & Control	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1572 Protocol Tunneling as an adversary behaviour. Tunnels run to the attacker's own server; only known-bad DNS names reach a sinkhole.
T1018 Remote System Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) A Virtual Honeypot Framework — Decoy hosts on unused addresses are found, and logged, by an attacker mapping the network. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1018 to its Lures activity.
T1049 System Network Connections Discovery	Discovery	theoretical	weak	T2
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1049 System Network Connections Discovery as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1049 to its Lures activity. Listing network connections (netstat) touches no decoy and produces no per-object event.
T1595 Active Scanning	Reconnaissance	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1595 to its Lures activity.
T1595.001 Scanning IP Blocks	Reconnaissance	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives scanning tools. The UCSD Network Telescope — The UCSD Network Telescope observes scans directed at a large routed but unused address block. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1595.001 Scanning IP Blocks as an adversary behaviour.
T1595.002 Vulnerability Scanning	Reconnaissance	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd deceives network scanning and fingerprinting tools. An Innovative Security Strategy using Reactive Web Application Honeypot — A reactive web-application honeypot evaluates the attack requests sent to it. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1595.002 Vulnerability Scanning as an adversary behaviour.

Evidence

Three Decades of Deception Techniques in Active Cyber Defense — Retrospect and Outlook — Zhang, L.; Thing, V. L. L., arXiv:2104.03594 2021 peer-reviewed
LaBrea: "Sticky" Honeypot and IDS (project page) — Liston, T., 2001 industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard