Endlessh: An SSH Tarpit

And (hopefully) Endlessh convinces attackers not to look around for an SSH server on another port. The most straightforward way to implement something like Endlessh is a fork server: accept a connection, fork, and the child simply alternates between and :

A process per connection is a lot of overhead when connections are expected to be up hours or even weeks at a time. With a server, the biggest overhead remaining is in the kernel, where it allocates send and receive buffers for each client and manages the proper TCP state.

Source: nullprogram.com