LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 02-15-2006, 04:03 PM   #1
abefroman
Senior Member
 
Registered: Feb 2004
Location: Chicago
Distribution: CentOS
Posts: 1,265

Rep: Reputation: 53
Is there a way to drop connections?


I blocked 69.93.138.106 with apf -d and netstat still shows he is connected 166 times.
166 69.93.138.106

I tried restarting apache and that didnt work.

How can I completely block his connections?
 
Old 02-15-2006, 07:24 PM   #2
kvedaa
Member
 
Registered: Mar 2004
Location: Virginia
Distribution: PacketProtector
Posts: 331

Rep: Reputation: 30
Try the tcpkill command. For more info take a look at:

http://www.cyberciti.biz/howto/quest...ux-netstat.php

Happy hunting.
 
Old 02-15-2006, 07:54 PM   #3
int0x80
Member
 
Registered: Sep 2002
Location: Cincinnati
Distribution: Debian GNU/Linux
Posts: 310

Rep: Reputation: 31
# ethX is your network card (eg: eth0)
iptables -I INPUT -i ethX -p tcp -s 69.93.138.106 -j DROP
iptables -I OUTPUT -o ethX -p tcp -d 69.93.138.106 -j DROP
 
Old 02-17-2006, 10:52 AM   #4
abefroman
Senior Member
 
Registered: Feb 2004
Location: Chicago
Distribution: CentOS
Posts: 1,265

Original Poster
Rep: Reputation: 53
Quote:
Originally Posted by kvedaa
Try the tcpkill command. For more info take a look at:

http://www.cyberciti.biz/howto/quest...ux-netstat.php

Happy hunting.
Where can I get that?
root@server1 [~]# tcpkill host 66.152.98.72
-bash: tcpkill: command not found
root@server1 [~]# locate tcpkill
root@server1 [~]#
 
Old 02-20-2006, 04:10 AM   #5
nx5000
Senior Member
 
Registered: Sep 2005
Location: Out
Posts: 3,307

Rep: Reputation: 52
Its part of dsniff package:

http://monkey.org/~dugsong/dsniff/


edit:

As dsniff needs a lot of dependencies, it may be easier to use hping3.
Using hping3 you should be able to nuke your offender (or better yourself if he is firewalled or if you don't want him to see you nuking) by sending an icmp error packet. This should cut the connection. You will need (his ip adress,his remote TCP port,your ip adress, your destination TCP port:80)

Last edited by nx5000; 02-20-2006 at 04:31 AM.
 
Old 02-20-2006, 01:17 PM   #6
primo
Member
 
Registered: Jun 2005
Posts: 542

Rep: Reputation: 34
It may be done easily with an iptables script since it is faster and machines may (maliciously) ignore packets. Use REJECT instead of DROP so both machines see either TCP RST's (reset) or ICMP UNREACH as soon as they try to engage in communication so they'll drop states in the network stack.
 
Old 02-21-2006, 02:01 AM   #7
nx5000
Senior Member
 
Registered: Sep 2005
Location: Out
Posts: 3,307

Rep: Reputation: 52
Quote:
Originally Posted by primo
It may be done easily with an iptables script since it is faster
Yes this is the cleanest,I gave others just for fun

Quote:
Originally Posted by primo
machines may (maliciously) ignore packets.
Its why I said : send the icmp to your own host. If you don't maliciously ignore these packets, the connection will effectively be torn, at least from your part.
 
Old 02-21-2006, 02:25 AM   #8
primo
Member
 
Registered: Jun 2005
Posts: 542

Rep: Reputation: 34
Quote:
Originally Posted by nx5000
Its why I said : send the icmp to your own host. If you don't maliciously ignore these packets, the connection will effectively be torn, at least from your part.
Well, it is an option if you don't want to use your own available bandwidth answering every malicious request, but sending the attacker these reset packets (when it doesn't matter that he sees them) has the benefit of preventing his network stack from retrying old TCP connections. Maybe the best option would be temporarily using REJECT for 1 or 2 minutes, then using DROP.
 
Old 03-13-2007, 09:59 AM   #9
esekla
LQ Newbie
 
Registered: Mar 2007
Posts: 2

Rep: Reputation: 0
dsniff update

It looks like dsniff has been ported to newer libraries and had some other updates from Debian. Apparently they passed those back upstream, but it's unclear to me what, if anything is being done with them there.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
2000 MySQL connections, still "too many connections" newlinuxnewbie Linux - General 0 11-07-2005 01:03 PM
Drop connections to port 80 at firewall machine also drop at protected network? Niceman2005 Linux - Security 2 10-27-2005 08:21 AM
drop line jmdlcar Slackware 2 03-13-2005 11:28 PM
iptables - drop all -> allow needed OR allow all -> drop specific lucastic Linux - Security 5 12-21-2004 02:07 AM
connections drop frequently carmeng Linux - General 1 12-12-2001 05:28 PM


All times are GMT -5. The time now is 10:03 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration