If a firewall can stealth all ports that are closed, then why cant they tarpit all of them? Think about it. If you are stealth apart from x y and z ports then they know whats what very quickly. If all your ports seemed to be open and the firewall delt with them as 8sign does and keeps in internal and uses no resources for the "tarpitted" ports then their scanns would come back all open but they dont know what to do and how to do it. they would have to telnet all the ports and see whats what. I tried to tarpit all incoming with 8 signs but it takes it too literally. Any ideas or thoughts on this?