Endlessh vs SNARE

Endlessh is a free, self-hosted SSH tarpit for Linux. It slowly sends random SSH banner text without ending, keeping unwanted SSH clients occupied for long periods. The project describes placing a real SSH server on another port so clients that connect to the tarpit remain there instead. Endlessh is a standalone, single-threaded C program that uses poll() to handle multiple clients. Because it sends the banner before cryptographic exchange, it does not rely on cryptographic libraries. Defaults include a 10000-millisecond interval between messages, a maximum banner line length of 32 characters, and a maximum of 4096 clients; excess connections wait in the queue. It supports IPv4 and IPv6, with options to bind to either address family alone. Diagnostics are quiet by default, with repeatable verbosity flags for standard and debug logging, plus syslog support. The configuration syntax is similar to OpenSSH and defaults to /etc/endlessh/config. The repository identifies the license as the Unlicense and provides GitHub Issues and Pull Requests for discussion and contributions.

SNARE has no write-up on Specifiction yet; its figures are above.