---
name: "blackhole"
section: "4"
platform: "linux"
package: "freebsd-manpages"
version: "6.0-5"
release: "Debian 4.0 (Etch)"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/blackhole/4"
---

# blackhole(4)

a sysctl(8) MIB for manipulating behaviour in respect of refused TCP or UDP connection attempts

## NAME

**blackhole** – a [sysctl(8)](/sysctl/8.md) MIB for manipulating behaviour in respect of refused TCP or UDP connection attempts

## SYNOPSIS

**sysctl** **net.inet.tcp.blackhole\[=\[0** \| **1** \| **2\]\]** **sysctl** **net.inet.udp.blackhole\[=\[0** \| **1\]\]**

## DESCRIPTION

The **blackhole** [sysctl(8)](/sysctl/8.md) MIB is used to control system behaviour when connection requests are received on TCP or UDP ports where there is no socket listening.

Normal behaviour, when a TCP SYN segment is received on a port where there is no socket accepting connections, is for the system to return a RST segment, and drop the connection. The connecting system will see this as a “Connection refused”. By setting the TCP blackhole MIB to a numeric value of one, the incoming SYN segment is merely dropped, and no RST is sent, making the system appear as a blackhole. By setting the MIB value to two, any segment arriving on a closed port is dropped without returning a RST. This provides some degree of protection against stealth port scans.

In the UDP instance, enabling blackhole behaviour turns off the sending of an ICMP port unreachable message in response to a UDP datagram which arrives on a port where there is no socket listening. It must be noted that this behaviour will prevent remote systems from running [traceroute(8)](/traceroute/8.md) to a system.

The blackhole behaviour is useful to slow down anyone who is port scanning a system, attempting to detect vulnerable services on a system. It could potentially also slow down someone who is attempting a denial of service attack.

## WARNING

The TCP and UDP blackhole features should not be regarded as a replacement for [ipfw(8)](/ipfw/8.md) as a tool for firewalling a system. In order to create a highly secure system, [ipfw(8)](/ipfw/8.md) should be used for protection, not the blackhole feature.

This mechanism is not a substitute for securing a system. It should be used together with other security mechanisms.

## SEE ALSO

[ip(4)](/ip/4.md), [tcp(4)](/tcp/4.md), [udp(4)](/udp/4.md), [ipfw(8)](/ipfw/8.md), [sysctl(8)](/sysctl/8.md)

## HISTORY

The TCP and UDP **blackhole** MIBs first appeared in FreeBSD 4.0.

## AUTHORS

Geoffrey M. Rehmet