Endlessh review
A focused, self-hosted SSH diversion tool for slowing automated scanners.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Endlessh is an open-source SSH tarpit for Linux and self-hosted deployments. It sends randomized, endless SSH banners at a deliberately slow pace, keeping automated scanning and brute-force clients connected for extended periods. The intended placement is in front of a real SSH server, where it can divert unwanted connection activity away from the production service. It suits administrators who want a narrow network-level decoy without a broader honeypot platform.
Pricing is straightforward: Endlessh uses an open-source model rather than tiered commercial plans. The published project details describe a standalone C program and license, with no paid plan structure to compare. Configuration covers the listening port, banner delay, maximum banner length, maximum client count, and IPv4 or IPv6 binding. Diagnostics can go to standard output or syslog, giving operators a choice of simple process output or system logging.
Its strength is focus. Endlessh uses a single-threaded design with poll() to handle multiple connections, and its concurrent-client support makes the SSH tarpit practical for diverting scanner traffic without adding credential-capture behavior. The trade-off is equally clear: it does not provide credential lures, documented integrations, or broader service emulation. Choose Endlessh when the goal is a lightweight SSH diversion layer; choose a broader honeypot when you need richer decoys, integrations, or multi-service interaction.
Endlessh pros and cons
- Where it wins
- Randomized endless banners keep automated SSH clients occupied
- Supports concurrent clients with IPv4 and IPv6 binding
- Configurable delays, ports, client limits, and diagnostics
- Where it doesn't
- Does not provide credential lures
- Offers no documented integrations
- Focuses on SSH rather than broader service emulation
Endlessh fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update