How do I 'break' an unwanted Internet connection?

rickh · 12-28-2005, 12:38 AM

I was looking at the 'Active Connections' on Firestarter. Most of them I was aware of and approved, but there were a couple I didn't understand. Had to reboot to get rid of them. Is there a command I could issue to break such a connection? Hopefully one that needs only the port # or ip address since that's all the info Firestarter is giving me.

Poetics · 12-28-2005, 01:07 AM

Could you give us some examples of connections you didn't want?

haertig · 12-28-2005, 11:42 AM

Quote:

Originally Posted by rickh

...Is there a command I could issue to break such a connection? Hopefully one that needs only the port # or ip address since that's all the info Firestarter is giving me.

Well, you could just kill the process that is using the port. That may or may not be a good thing.

To find out what process is using a given network connection:

As root, try running "netstat -np" or "lsof -i". Depending on how many connections you have you will probably need to pipe the output to a pager (pg, more, less, etc.) This will give you the process id and program name of the thing that's using the connection. Non-root users cannot get this information AFAIK.

rolsch · 12-29-2005, 07:50 AM

Sounds like you need dsniff, a package that basically sniffes network connections, but also comes with 2 useful tools you might want to take a look at:

* tcpkill - kills specified in-progress TCP connections.
* tcpnice - slow down specified TCP connections via "active" traffic shaping.

There is also a tool called 'cutter' which cuts off active ip connections, but I haven't used it. Just google for it.

Hope this helps.

rickh · 12-29-2005, 12:22 PM

Quote:

dsniff

Ooh! that sounds like exactly what I need. I was trying to get the problem to reoccur, so I could be a little more specific about the connections I didn't want, but it hasn't yet. It will tho, and I'm sure that the process involved is going to be java, which is also controlling connections I want to keep. Thus haertig's kill suggestion above is probably not going to work. His suggested troubleshooting commands work nicely, tho.

All I want to do is slam the door on specific connected ports.

finger_my_tty · 12-30-2005, 12:07 AM

another easy way to track connections is netstat.
"netstat -l" shows listening sockets
"netstat -p" shows pid of whats on the socket
"netstat -c" will scroll the connections continuos
those are just the couple i know off the top of my head reading man netstat should help if you need anything else.