Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Random message delay? #71

Open
benlenau opened this issue Oct 12, 2021 · 0 comments · May be fixed by #81
Open

Random message delay? #71

benlenau opened this issue Oct 12, 2021 · 0 comments · May be fixed by #81

Comments

@benlenau
Copy link

benlenau commented Oct 12, 2021 •
edited

Hi @skeeto, I've noticed that many ssh-bots have figured out that Endlessh is at play on my honeypot. b/c client disconnect happens at almost exactly double the message delay (I have of course increased delay time but the behavior remains). Any way to randomize message delay (fx MaxDelay)?

current behavior examples: delay@10000 = disconnect@20.022 | delay@12543 = disconnect@25.106
@Thomas131 Thomas131 linked a pull request Mar 10, 2022 that will close this issue
Open
rarescosma added a commit to rarescosma/endlessh-go that referenced this issue May 9, 2024
@rarescosma
feat: implement interval jitter
e550c6e 
Adds a new argument called 'interval_jitter', expressed as a percentage
number (range 0-100) that has the following effects:

If 0 => no effect.

If >0 => choose a random integer in the
[-(interval * jitter / 100), +(interval * jitter / 100)] range

and add use it as an offset for the sleep interval.

So for example, if our interval is 1000ms and we pick
interval_jitter=20, then the sleep values will be
in the range [800ms, 1200ms]

This has been a requested feature in the original implementation,
and is useful to twarth SSH scanners that have tarpit-detecting logic.

Link: skeeto/endlessh#71
@rarescosma rarescosma mentioned this issue May 9, 2024
Open
rarescosma added a commit to rarescosma/endlessh-go that referenced this issue May 9, 2024
@rarescosma
feat: implement interval jitter
e28a0c4 
Adds a new argument called 'interval_jitter', expressed as a percentage
number (range 0-100) that has the following effects:

If 0 => no effect.

If >0 => choose a random integer in the
[-(interval * jitter / 100), +(interval * jitter / 100)] range

and add use it as an offset for the sleep interval.

So for example, if our interval is 1000ms and we pick
interval_jitter=20, then the sleep values will be
in the range [800ms, 1200ms]

This has been a requested feature in the original implementation,
and is useful to twarth SSH scanners that have tarpit-detecting logic.

Link: skeeto/endlessh#71
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Implement Jitter Thomas131/endlessh
1 participant
@benlenau