How To Use Portspoof (Cyber Deception)

This document is a tutorial on using Portspoof within the Active Defense Harbinger Distribution (ADHD) to implement cyber deception by redirecting all TCP ports to a local listener and returning randomized service banners, thereby making every port appear open and extending the time and effort required for Nmap scans. It covers configuring iptables to forward connections to Portspoof on port 4444, demonstrates basic and version-detection scans, and shows how a user-defined signature file generates misleading service responses to frustrate reconnaissance.