What Are Tarpits? Slowing Down Attackers by Wasting Their Time

Making attackers wait forever.

A tarpit is a network service designed to deliberately slow down, stall, or waste the resources of anything that connects to it. The name comes from the La Brea Tar Pits in Los Angeles — natural asphalt pools where prehistoric animals became trapped and could not escape. A network tarpit works on the same principle: an attacker or automated tool connects, expects a normal response, and instead becomes stuck — consuming time, memory, connections, and processing power while making no progress.

Tarpits are a form of active defence — they do not just block an attacker, they impose a cost. A firewall that drops traffic is invisible to the attacker; they simply move on to the next target. A tarpit that accepts the connection and then responds infinitely slowly forces the attacker to keep that connection open, tying up a socket, a thread, and attention. At scale, a tarpit can consume enough of an attacker's resources to meaningfully degrade their scanning speed, brute-force throughput, or spam delivery rate.

This is not a new concept. Tarpits have existed since the early 2000s. What has changed is their relevance: as automated scanning, credential stuffing, and bot-driven attacks have become the dominant threat model for internet-facing services, techniques that waste attacker automation cycles have become increasingly valuable as part of a layered defence strategy.

The TCP mechanics of trapping a connection.

Tarpits exploit fundamental properties of TCP — the protocol that underlies most internet communication. Understanding the mechanics requires a brief look at how TCP connections are established and maintained, and how a tarpit subverts each stage to waste the attacker's resources.

The key insight is that TCP was designed to be resilient. When a server responds slowly, the client waits — this is expected behaviour for congested networks. TCP's retransmission timers, keep-alive mechanisms, and flow control all work in the tarpit's favour: the client's operating system keeps the connection alive, consumes a socket, and ties up the attacking tool's connection slot. The attacker's software cannot easily distinguish a tarpit from a genuinely slow server.

Different traps for different threats.

Tarpits have evolved to target different types of attacker activity. Each type exploits the specific protocol and behavioural expectations of the attacker's tools, maximising the time and resources wasted per connection.

The SSH tarpit that changed the conversation.

Endlessh, created by Chris Wellons in 2019, is the tool that brought tarpits back into mainstream security discussion. It is elegantly simple: it listens on a TCP port (typically 22), and when a client connects, it sends an infinite SSH banner — one random line every 10 to 30 seconds. The SSH protocol specification (RFC 4253) states that the server may send a banner before the version string, and the client must wait for the version string before proceeding. Endlessh exploits this by never sending the version string. The client waits. And waits. And waits.

The results are remarkable. On any internet-facing server, SSH brute-force attempts are constant — typically hundreds to thousands per day. An Endlessh deployment on port 22 routinely traps individual bots for hours at a time. A single Endlessh instance running on modest hardware can hold thousands of connections simultaneously, consuming negligible server resources (each trapped connection uses approximately 120 bytes of memory) while consuming significant resources on the attacker's side.

The original tarpit — trapping entire subnets.

LaBrea, created by Tom Liston in 2001, is the tool that defined the network tarpit concept. It operates at the TCP/IP level and is designed to answer connection attempts to unused IP addresses in a network. LaBrea monitors ARP requests on the local network — when it detects a request for an IP address that no real host answers, it responds on that address's behalf, completing the TCP handshake and then holding the connection open using TCP window size manipulation.

The effect is powerful: a scanner probing a /24 subnet that contains 50 real hosts and 200 unused addresses will find all 254 addresses responding. The 200 LaBrea-answered connections trap the scanner, consuming its connection pool. Worms that propagate by scanning for vulnerable hosts are particularly affected — instead of finding real targets, they become mired in tarpitted connections that never complete, dramatically slowing propagation speed.

LaBrea's approach is aggressive and best suited to environments with large unused IP spaces — data centres, DMZ networks, or honeypot deployments. It is less suitable for busy internal networks where ARP dynamics are complex and false positives could affect legitimate traffic. Modern alternatives like iptables TARPIT targets achieve similar results using netfilter rather than ARP manipulation, offering more granular control over which connections are tarpitted.

Trapping web scrapers and vulnerability scanners.

HTTP tarpits exploit the fact that web clients — including automated scanners, scrapers, and bots — expect servers to deliver content. An HTTP tarpit accepts the connection, sends valid HTTP headers indicating a successful response, and then delivers the body at an agonisingly slow pace. The client has already received the 200 OK status and content-type header, so it waits for the body to complete rather than timing out and moving on.

Some HTTP tarpits take a more creative approach. They generate infinite HTML pages containing fake links, form fields, hidden directories, and random text. Web crawlers and vulnerability scanners follow these links, discovering ever more pages to scan — each of which is itself a tarpit generating more fake content. The scanner becomes trapped in an infinite recursion of non-existent pages, consuming its queue, memory, and time.

Why tarpits matter in a layered defence.

Tarpits are not a replacement for firewalls, intrusion detection, patching, or any other security control. They are a force multiplier that adds a unique capability to a layered defence: the ability to impose a cost on attackers.

What tarpits cannot do.

Tarpits are effective against automated, high-volume attacks — but they have clear limitations that must be understood to deploy them effectively.

What tarpits look like from the attacker's side.

As penetration testers, we encounter tarpits during external engagements. A well-deployed tarpit is immediately recognisable to an experienced tester — but it is a signal that the organisation takes active defence seriously, and it forces the tester to adjust their approach.

Where and how to deploy tarpits effectively.

The bottom line.

Tarpits are a defensive technique that deliberately slows, stalls, and wastes the resources of attackers by accepting their connections and responding infinitely slowly. They exploit fundamental properties of TCP, SSH, HTTP, and SMTP to trap automated tools in connections that consume attacker resources while costing the defender almost nothing.

They are not a silver bullet. They do not replace firewalls, patching, authentication controls, or monitoring. They are most effective against automated, high-volume attacks — the SSH brute-force bots, port scanners, web scrapers, and spam engines that constitute the background radiation of internet-facing infrastructure. Against these threats, a single Endlessh instance or a set of iptables TARPIT rules provides a continuous, zero-maintenance defence that imposes real cost on attackers.

In a threat landscape dominated by automation, any technique that wastes attacker automation cycles is a net positive for the defender. Tarpits turn unused IP addresses and unused ports from dead space into active defence — and the prehistoric animals that wandered into the La Brea Tar Pits would tell you, if they could, that sometimes the most effective trap is the one you walk into without knowing it.