I’ve read an article which describes how to simulate the close ports as open in Linux by eBPF. That is, an outside port scanner, malicious actor, will get tricked to observe that some ports, or all of them, are open, whereas in reality they’ll be closed.
How could this be useful for the owner of a server? Wouldn’t it be better to pretend otherwise: open port -> closed?
Possibly to confuse os detection. Not sure if it would be sufficient though.
Or slow down a complete scan, it would take a long time to scan all likely ports on a machine stealthily, and be quite obvious if that machine is set up as a honeypot.