|
A honeypot is configured insecurely by design. The idea is to fool attackers into compromising an easy target, so the owners can track what attackers use to break into systems (so that holes can be found and plugged), and also to learn what methods are employed to cover their tracks (i.e to identify rootkits and such).
A tarpit introduces a delay in each connection attempt, often increasing with more attempts from the same host. For example, you might have your mail server introduce a small delay if a machine connects more than twice in two seconds. Then if someone is using your mail server to send spam, every subsequent message will take longer and longer to send, making the activity uneconomical for the spammer (theoretically forcing him to give up, but more realistically forcing him to use someone else's server). This does not inconvenience legitimate users of the service, except perhaps in a few specific cases. A mail server is not the only case - it could be used to slow down port scans as m00t00 said, or other services.
|
