Effectiveness of ssh Tarpitting

How should you decide how well ssh tarpitting works? Can you tell if the people who run ssh password guessers have changed their code to account for the presence of endlessh in their target population?

A fellow named Ben Tasker wrote his own ssh tarpit. which I think is a good idea. He did an initial look at his tarpit in 2021 that looked at what countries the guesser worked out of.

He tried to figure out if his tarpit was effective in 2022 and in 2026.

Tasker’s 2022 measures of effectiveness

Tasker takes a week of ssh connection attempts, 2022-07-08T10:57:54Z through 2022-07-16T10:57:54Z. Tasker calls “elapsed time of password guesser waiting for banner transmission to finish” the “stick time”.

He sorted by stick time and chose the longest 1000. He looks at the shortest and longest durations of those 1000 attempts. He also creates a cumulative distribution function (CDF) although he doesn’t call it that. I believe the CDF is for all connections during his one week sample. From the CDF, he picks a median (“11.something seconds”), but also does not call it “the median stick time”.

Tasker’s 2026 measures of effectiveness

In 2026, Tasker uses the week of 2026-08-01T00:00:00Z through 2026-08-08T00:00:00Z.

He does not give a distribution of stick time for his week in 2026, but he does calculate weekly sums of stick time, count the number of connections made, and a mean stick time. I don’t see that he makes any attempt to deal with repeated connections from the same IP address.

In both 2022 and 2026, Tasker counts up connection attempts by country, apparently based on geolocating IP addresses. I fail to see how this is interesting at all, given transnational data center ownership, say data centers in Luxembourg or Andorra being owned by UK companies.

My Data

I scrounged up a number of endlessh log files from my backups, all created with the command like journalctl -u endlessh. There was some duplication, but those dupes are easily filtered out.

I have endlessh journal logging from two network providers, for three number of intervals. I believe I kept track of the Verso Networks endlessh data starting immediately after I installed it. It looks like I kept endlessh journal text from when I got back on CenturyLink fiber until I lost interest, then started again earlier this year.

Provider	From date	To date
Verso Network	2019-11-16	2020-01-31
CenturyLink	2021-10-20	2023-09-02
CenturyLink	2025-06-17	2025-07-07
CenturyLink	2025-07-24	2025-09-08
CenturyLink	2026-04-17	2026-08-12

endlessh logs socket connections and closes annotated with remote IP address. It also logs count of concurrent sessions with socket connection. Duration of session gets logged on socket closes. That’s the data I possess, from which I hope to get answers.

After futzing around with the data and reading Ben Tasker’s articles, I feel like you can’t separate the questions of “do those who run password guessers change their algorithms in response to tarpits?”, and “are tarpits still effective?”. Those are almost two ways to phrase the same question. Beyond that, the notion of “effective” could use some examination. Is the question an economic question, where keeping ssh password guessers occupied has a cost and a value, where you abandon your tarpit when the cost exceeds the value? I’m going to use the phrasing of “has password guessing behavior changed over time” because I’ve run the same endlessh program for a long time. My tarpit hasn’t changed.

Visualizations

I’m interested in if password guessers have changed with time. I want to find out if the humans behind the guessing have changed their programs’ behavior. That means that any indicator like mean stick time, or ssh sessions or unique IP addresses per day has to be seen to change as time progresses. Towards that end, I’ll show some indicators that might demonstrate changing password guessing behavior,

I want to see if a rate of ssh guessing changes with time. Since an ssh session constitutes a discrete event, rather than some value of a continuous process, I choose the interval of one, 24-hour UTC day. Hopefully, this will smooth out some freaky high numbers and freaky low number of indicators.

Here we have counts of ssh socket openings. This is a visualization of ACCEPT lines of endlessh logging. It leaves out three days where the count of ACCEPT log lines was above 2500: 2022-09-26 (2649 sessions), 2022-09-27 (2668 sessions), 2021-10-29 (10513 sessions). Showing those three days compressed the rest of the data into incomprehensibility.

I can’t easily see the five periods of logging. The visualization above looks like four sets of data because there’s only a small gap between 2025-07-07 and 2025-07-24. I can’t explain why the 2021-10-20 through 2023-09-02 period has such low daily session count relative to the other periods. It could be that password guessers hadn’t twigged to CenturyLink putting residential connections on those IP address ranges, but that’s just a guess.

Above, the number of unique IP addresses that started an ssh session during a UTC day. There’s considerable variation over the span of my data. I don’t have explanations for the sudden shift vertically at 2020-01-01 or just after 2023-01-01.

Here’s a way to characterize password guesser behavior: the number of ssh sessions per IP address that does the guessing. It certainly looks like guesser behavior has changed. During the 2020 logging, any given IP address timed out and tried again many times, between 20 and 30 times. The 2021-10-20 through 2023-09-02 logging has far fewer sessions per IP address. In 2025 and 2026, the guessers again logged more sessions per IP address. The data shows some distinct changes in algorithm.

Tasker considered the median “stick time”, the median time that password guessers spent waiting for his tarpit’s banner text to finish arriving.

Above, a visualization of ssh tarpitting effectiveness, the daily median duration that endlessh send banner text to a password guesser before it terminates the session. This visualization leaves out 2023-08-21, which had a median of 950.034 seconds. Including that median compressed the rest of the data so that no structure could be seen in it.

Unlike the number of ssh sessions per day, the median duration a password guesser waited has increased as time goes on.

Results

Even these simple visualizations show that my tarpitting is more effective now in 2026 than it was 2021-10-20 through 2023-09-02. I think Ben Tasker’s conclusion that ssh tarpitting was losing effectiveness is untrue.

There are of course confounding factors:

1. Verso Networks, a very fine ISP, gave me a static IPv4 address, and a /64 IPv6 prefix.
2. CenturyLink, a not so fine ISP, doesn’t let you keep any given IPv4 address for very long.
3. I believe that CenturyLink IP address ranges are well-known to the bottom feeder community as full of soft targets, residences with cheap, consumer grade WiFi routers protecting them, and are therefore targetted regularly.

Based on my data, it does look like ssh password guessing programs have changed behavior over the years. They don’t do as many sessions before giving up and moving along, and the timeouts seem to have risen, not gotten shorter.

It’s pretty clear that tarpitting ssh password guessers eats up bottom feeders’ time and effort. Tarpitting has to be considered good stewardship for The Internet.