SSH brute force attacks everyday more present. Every server owner has watched their SSH logs fill up with the same tedious pattern: bots cycling through “admin/admin,” “root/123456,” and every other obvious password combination they can think of. It’s like digital door-to-door salespeople, except they never get tired and they’re not actually selling anything to you but to the others.
Most people respond exactly how you’d expect: change the default port, install fail2ban, disable password authentication entirely. All perfectly reasonable reactions to an unreasonable problem.
But here’s a different approach that’s way more entertaining: instead of hiding from the bots, invite them over for a very long, very boring conversation.
How It Actually Works
The SSH protocol includes something called a banner that displays text before authentication. There’s no limit on how long this banner can be or how slowly it gets sent.
A tarpit exploits this by creating a fake SSH server that sends an endless banner, one character at a time, very slowly. Bots connect expecting a quick login prompt. Instead they get stuck reading random text that never ends.
You move your real SSH server to a different port. Legitimate users connect normally while bots get trapped by the decoy.
The Bot Economics Problem
Automated attacks work on volume. Bots need to test hundreds of servers per hour to find vulnerable ones. Their scripts are optimized for speed — connect, try passwords, get rejected, move to the next target in seconds.
Tarpits break this model. Instead of processing 200 servers per hour, bots get stuck on individual connections that consume resources while producing zero results.
Most bots do have timeouts — usually 30 seconds to 5 minutes. But that’s exactly the point. During those entire 5 minutes, they’re burning CPU and bandwidth on your server while their operators get nothing useful. You’ve turned their infrastructure against them.
Even better: the timeout is working in your favor, not theirs.
What You Actually See
Deploy a tarpit and within hours you’ll have dozens of connections doing absolutely nothing. The logs show fascinating patterns:
- Geographic clustering that reveals botnet distribution
- Activity waves matching business hours in different time zones
- Credential attempts using passwords from recent data breaches
- Some bots reconnecting repeatedly; others learning to avoid you
The diversity shows how complex the modern attack ecosystem really is. Some operations are sophisticated, others are just script kiddies running tools they don’t understand.
The AI Angle
As AI gets integrated into attack tools, tarpits become more interesting. AI-powered bots are designed to learn and adapt, but they still operate under economic constraints.
Time spent analyzing a tarpit’s random output is time not spent finding actual vulnerabilities. More sophisticated AI will eventually detect tarpits, but that just means attackers have to invest more resources in reconnaissance.
The irony: as AI makes attacks smarter, it also makes them more expensive. Tarpits force AI systems to waste computational resources analyzing garbage data.
Beyond SSH
The concept works for other protocols too. Web tarpits serve extremely slow pages to malicious crawlers. SMTP tarpits accept email connections but never complete transactions. Database tarpits simulate slow responses to reconnaissance tools.
Any protocol that lets servers send data before authentication can become a resource trap. The key is making attacks expensive rather than just blocking them.
What This Actually Accomplishes
Tarpits represent a shift from hiding to actively wasting attacker resources. You’re not just protecting your server — you’re making mass scanning less profitable across the internet.
This matters more than individual defensive measures because it addresses the economic incentives. Most defenses just shift attacks to easier targets. Tarpits actually reduce the profitability of automated scanning.
The setup is straightforward, resource requirements are minimal, and there’s genuine satisfaction in knowing somewhere out there, attack scripts are sitting in digital quicksand accomplishing nothing while you sleep.
The Neighbor Protection Racket
Here’s an interesting side effect: your tarpit accidentally protects nearby IP addresses. Bots scanning sequential IP ranges get bogged down on your address, creating gaps in their scanning patterns.
Your neighbors at 192.168.1.100 and 192.168.1.102 are statistically safer because the bot got stuck at 192.168.1.101 for three hours. You’ve become an involuntary digital neighborhood watch, creating safe zones around your server simply by existing.
Limitations Worth Knowing
Tarpits work against automated, opportunistic scanning. They won’t stop someone who specifically wants access to your server. Sophisticated attackers will recognize and avoid them.
You need basic monitoring to prevent resource exhaustion from thousands of concurrent connections. And yes, you can trap yourself if you forget about the port change.
But for their intended purpose — wasting bot resources and making mass attacks less profitable — they’re remarkably effective.
Every hour a bot spends stuck on your tarpit is an hour not spent attacking other servers. In a world where security often feels like a defensive battle, that’s worth doing.