how to kill active TCP connections

~=gr3p=~ · 02-11-2006, 01:41 AM

I know one tool called cutter which can be used to kill an active tcp connections from netstat -na output. this is useful incase u want to immediately kill a malicious client connection to ur server. problem is cutter doesn't work on my Fedora C3. dsniff contains tcpkill but dsniff refuses to compile & install on FC3

any alternatives?

TIA

nx5000 · 02-11-2006, 05:29 AM

This is a bit straightforward but you can cut connectivity on the IP layer:

Code:

iphole.sh:
#!/bin/sh
route add -host $1 gw 127.0.0.1 

#iphole 11.22.33.44

You will cut all connections with this host, not only one!

I've found this on google for dsniff compilation on fc3, you can give it a try
http://www.enzotech.net/dsniff.html

ExplodingTurnip · 02-11-2006, 09:58 AM

You could also use IPTables which works on all Linux distros.

For dropping traffic from a single host I use:

Code:

iptables -I INPUT -s <ip address> -j DROP

Just replace <ip address> with the address of the host that you want to drop traffic from.