Hacker News Reader

Comment by EvanAnderson | Hacker News Reader

I haven't used it in years, but Tom Liston's "Labrea" tarpit is an interesting take on this concept: https://github.com/Hirato/LaBrea

It listens in your unused IP space and both tar-pits scanners and creates actionable intelligence about scans against your hosts.

View on HN

I love the fake arp responses, that's a brilliant way so you can run this on any machine (doesn't have to be a router) and not worry about managing new hosts (no black/whitelist to manage of which IPs are unused).

I'm definitely not going to try this because it sounds like an easy way to get in trouble, but would this work on a host like DO/linode/vultr, etc? Again, this seems really easy to detect

Yes be super careful with Labrea on VPS providers and dedicated server providers. They tend to get upset if you are trying to pick up IP's. In most cases it won't even work on KVM hosts.

I've used Labrea on unused address space to make ARIN/RIPE happy back in the day and that was harmless, as entire /16's and /17's were unused. They used to nag about nothing in the /16's being pingable, so Labrea made it all 100% pingable

Why hold onto addresses you're not using? This is against the allocation requirements and lead to the IPv4 exhaustion we have now.

If you have an ARIN allocation, there is no reason you would ever want to decrease the amount of addresses you own. You own them.

Whether you own them or not is subject to a lot of debate and not clear cut. If you owned them, why would you need to fool ARIN into believing they are being utilised?

The agreement you make to get an allocation requires a certain level of utilization depending on the size of the block to prevent squatting and exhaustion of resources. This is a good thing, and if it was actually respected we wouldn't be in a mad rush to migrate to IPv6.

"Mad rush" - heh. I'd hate to see how long something rolled out at a leisurely pace would take!

> IPv6 is intended to replace IPv4. In December 1998, IPv6 became a Draft Standard for the IETF, who subsequently ratified it as an Internet Standard on 14 July 2017

it only took 20 years to standardize after all. we're seriously rushing here!

Oh I was thinking home network or some small business. I'm not yet used to this cloud thing, still hosting my email and website at home. For a network that is not yours, like at a VPS provider, I would totally not try this. They would not be amused.

Reply on news.ycombinator.com