Is there a way to drop connections?

abefroman · 02-15-2006, 04:03 PM

I blocked 69.93.138.106 with apf -d and netstat still shows he is connected 166 times.
166 69.93.138.106

I tried restarting apache and that didnt work.

How can I completely block his connections?

kvedaa · 02-15-2006, 07:24 PM

Try the tcpkill command. For more info take a look at:

http://www.cyberciti.biz/howto/quest...ux-netstat.php

Happy hunting.

int0x80 · 02-15-2006, 07:54 PM

# ethX is your network card (eg: eth0)
iptables -I INPUT -i ethX -p tcp -s 69.93.138.106 -j DROP
iptables -I OUTPUT -o ethX -p tcp -d 69.93.138.106 -j DROP

abefroman · 02-17-2006, 10:52 AM

Quote:

Originally Posted by kvedaa

Try the tcpkill command. For more info take a look at:

http://www.cyberciti.biz/howto/quest...ux-netstat.php

Happy hunting.

Where can I get that?
root@server1 [~]# tcpkill host 66.152.98.72
-bash: tcpkill: command not found
root@server1 [~]# locate tcpkill
root@server1 [~]#

nx5000 · 02-20-2006, 04:10 AM

Its part of dsniff package:

http://monkey.org/~dugsong/dsniff/

edit:

As dsniff needs a lot of dependencies, it may be easier to use hping3.
Using hping3 you should be able to nuke your offender (or better yourself if he is firewalled or if you don't want him to see you nuking) by sending an icmp error packet. This should cut the connection. You will need (his ip adress,his remote TCP port,your ip adress, your destination TCP port:80)

primo · 02-20-2006, 01:17 PM

It may be done easily with an iptables script since it is faster and machines may (maliciously) ignore packets. Use REJECT instead of DROP so both machines see either TCP RST's (reset) or ICMP UNREACH as soon as they try to engage in communication so they'll drop states in the network stack.

nx5000 · 02-21-2006, 02:01 AM

Quote:

Originally Posted by primo

It may be done easily with an iptables script since it is faster

Yes this is the cleanest,I gave others just for fun

Quote:

Originally Posted by primo

machines may (maliciously) ignore packets.

Its why I said : send the icmp to your own host. If you don't maliciously ignore these packets, the connection will effectively be torn, at least from your part.

primo · 02-21-2006, 02:25 AM

Quote:

Originally Posted by nx5000

Its why I said : send the icmp to your own host. If you don't maliciously ignore these packets, the connection will effectively be torn, at least from your part.

Well, it is an option if you don't want to use your own available bandwidth answering every malicious request, but sending the attacker these reset packets (when it doesn't matter that he sees them) has the benefit of preventing his network stack from retrying old TCP connections. Maybe the best option would be temporarily using REJECT for 1 or 2 minutes, then using DROP.

esekla · 03-13-2007, 09:59 AM

It looks like dsniff has been ported to newer libraries and had some other updates from Debian. Apparently they passed those back upstream, but it's unclear to me what, if anything is being done with them there.