grsecurity forums

I see the stealth patch compiled cleanly in the kernel, however, I don't see a stealth patch for iptables itself? Are there plans for this?

"stealth patch" ... ? What's that?

It's an iptables target that checks whether there's an application listening on the desired port. If an application is present, the target behaves like ACCEPT. If there's no application listening, the target behaves like DROP. It's useful if you want to expose a server that's not always running, but not make yourself visible to a portscan when the server's not runninig.