I’ve read an article which describes how to simulate the close ports as open in Linux by eBPF. That is, an outside port scanner, malicious actor, will get tricked to observe that some ports, or all of them, are open, whereas in reality they’ll be closed.
How could this be useful for the owner of a server? Wouldn’t it be better to pretend otherwise: open port -> closed?
Port knocking does not require open ports though? It works by trying to connect to closed ports in a specific sequence does it not?
or maybe fake ports?
What is a fake port?