v2.0 — Tarpit Engine
Replaces the connection handling engine. Connections now hold open
after banner delivery instead of closing.
What changed
- epoll edge-triggered event loop (single-threaded, ~1-2KB per connection)
- Three delivery modes per port: immediate banner, wait-for-client, silent hold
- Logarithmic timeout distribution with per-connection jitter
- Connection eviction (nearest-to-expiry) at fd capacity
- Revregex signed-char buffer fix
Bypass resistance
Verified against connection persistence filtering, timing fingerprinting,
banner consistency analysis, response variance, resource exhaustion,
and multi-feature pattern model clustering. No approach distinguishes
real services from portspoof at scale.