Portspoof simulates open ports and service signatures across all 65535 TCP ports, transforming reconnaissance into a time-consuming, resource-intensive process. Portspoof responds with convincing fake services, making it difficult to identify real services. It achieves this by utilizing a single-threaded event loop and dynamically generated responses, exploiting the asymmetry between the defender's resource consumption and the attacker's scanning time.
Portspoof's key features include emulating all 65535 TCP ports, generating dynamic service signatures, employing mixed delivery modes for unpredictable response times, and offering an 'Exploitation Framework Frontend'. It's lightweight, secure, and requires no root privileges, making it suitable for resource-constrained environments. The design focuses on maximizing time and resource consumption for attackers while minimizing impact on the system.
- Comprehensive Port Coverage: Emulates all 65535 TCP ports, challenging traditional reconnaissance techniques.
- Dynamic Service Signatures: Uses regular expressions to generate over 9000 distinct service identities.
- Mixed Delivery Modes: Implements varied connection behaviors (immediate, delayed, silent) to disrupt timing-based detection.
- Lightweight Operation: Runs in userland with minimal CPU and memory usage; no root privileges needed.
- Offensive Defense: Can be applied as a frontend for exploiting vulnerabilities in scanners.
- Asymmetrical Resource Consumption: Causes the attacker to expend significantly more resources than the defender.
- Flexible Configuration: Can be configured to adjust timing parameters and service signatures.
Portspoof is an active project with recent commits, indicating ongoing maintenance and development. The documentation provides setup instructions and configuration details. While not extensively covered by the community, its core functionality is stable and demonstrably effective in disrupting port scanning. Regular testing and updates are conducted to address performance and security considerations.
Portspoof benefits system administrators and security professionals seeking to protect their systems from reconnaissance attacks. It addresses vulnerabilities in vulnerability scanning, provides a strong defense mechanism, and greatly increases the time and effort required to gather information about a target. It excels in situations where a prolonged and resource-intensive defense is desirable over simple detection.