I’ve read an article which describes how to simulate the close ports as open in Linux by eBPF. That is, an outside port scanner, malicious actor, will get tricked to observe that some ports, or all of them, are open, whereas in reality they’ll be closed.
How could this be useful for the owner of a server? Wouldn’t it be better to pretend otherwise: open port -> closed?
Its costs him time - which is the point. They would have to do more detailed checks on every port which costs them time. Attackers are typically scanning loads of ports over large ranges of IPs, any small slow down on each can drastically slow down their overall progress making the attack less feasible and more expensive to undertake.
but an attacker isn’t obliged to take on all the open ports, he could work with some of them - the ones that may seem the most interesting to him