Board:   [DoveNet] Unix/Linux
Subject: Re: SSH honeypot: what 3,
From:    ant
Date:    Tue Sep 01, 2026 03:42

Subject: Re: SSH honeypot: what 3,500 sessions/day look like
@VIA: SYNCNIX
Echo0:

> For the Unix crowd: I run Cowrie on port 22 and it sees
> ~3,500 sessions a day.

There are several more methods of preventing this:

  1.  fail2ban, blocklistd, and the like,

  2.  drop ping requests silently (via firewall config), to
      prevent the automated discovery of your server

  3.  connect to SSH via ephemeral ports.
---
 * Synchronet * My Brand-New BBS (All the cool SysOps run STOCK!)
.