What is the difference between the Standard, Tarpit and Silent Drop blocking types?

Short answer

All three stop the request but behave differently toward the client; they are selected in the Deny Type field of the Block action in Load Balancer (default Standard). Standard rejects the request immediately and returns to the client the status code in the Status Code field (default 403). Tarpit deliberately keeps the connection open and delays the response; the waiting time is the Connect Timeout value in the Timeouts profile of the vService (default 20 seconds), and when the time expires the same status code is returned. The purpose is to slow down scanning tools, bots and brute-force attempts; Tarpit is offered only while Execution Level = On Request. Silent Drop terminates the connection without returning any HTTP response; the Status Code field is hidden. The rule actions of Bot/DDoS protection also have the Block, Tarpit and Silent Drop options.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Actions → Block	Deny Type: Standard, Tarpit, Silent Drop	The blocking method on an HTTP vService
Bot/DDoS Management → IP Reputation Protection, Bot Protection rule rows	Action: Block, Tarpit, Silent Drop; in addition Redirect, Show Content, Show Captcha, Quarantine	The enforcement to be applied to a request that matches the rule
Bot/DDoS Management → L7 DDoS Protection blocks	Action	Block and Silent Drop are present in all blocks; Tarpit can be selected only in the source IP based blocks (Source IP Request, Source IP Connection, Source IP Error Protection)
Load Balancer → Actions → TCP Connection Management	Action = Reject or Silent Drop	Rejecting the connection or dropping it without a response on an L7 TCP vService

Tarpit and Block (Standard) work only on an HTTP vService; since an HTTP response cannot be produced on an L7 TCP vService, the Bot/DDoS default rules carry Silent Drop instead of Block.

Comparison

	Standard	Tarpit	Silent Drop
Response to the client	Status code, immediately	Status code, at the end of the Connect Timeout time	None
Connection	Closes with the response	Kept open for the duration	Terminated without a response
Status Code field	Visible (default 403)	Visible (default 403)	Hidden
Suitable case	Ordinary blocking; the client sees why it was rejected	Slowing down scanning, bot and brute-force tools	Not giving information to traffic that is clearly malicious

Common Misconceptions

• "Tarpit puts no load on the device." The connections kept open use resources on TR7 too; Tarpit is used only for suspicious traffic.
• "Silent Drop also hides from the logs the fact that the request was blocked." Only the response to the client is withheld; a record is created in the TR7 logs.
• "The Tarpit time is set in a separate field." The time is the Connect Timeout value of the Timeouts profile bound to the vService; when this value is changed, the Tarpit time also changes.

How it is done in the documentation

• Block · Deny Type
• Block · Execution Level
• Timeouts · Connect Timeout
• TCP Connection Management

Related questions

• Is it possible to reject or silently drop a connection at the TCP level (TCP Connection Management)?
• What is Quarantine; how does it differ from blocking and where is it used in TR7?
• What is a brute-force attack; how does TR7 protect the management interface and applications against it?