October 3, 2010 at 17:37Working method for breaking a specific active connection from the linux command line (drop / kill / cut / close ESTABLISHED connection)
Sometimes it is necessary to forcibly break an active connection. The most common way:
The problem is that one worker can simultaneously serve several connections, so it would be more correct to kill the connection and not the worker. For this, many forums recommend using tcpkilll , cutter or awk + hping3 . However, even though these utilities are in the official repositories, I could not get them to disconnect.
After lengthy searches, the perl killcx script was discovered , breaking the connection on the remote host and port.
It requires a whole set of libraries to work.
netstat -na
kill PIDkillcx 94.133.119.242:4403[PARENT] checking connection with [94.133.119.242:4403]
[PARENT] found connection with [78.220.184.126:80] (ESTABLISHED)
[PARENT] forking child
[CHILD] interface not defined, will use [eth0]
[CHILD] setting up filter to sniff ACK on [eth0] for 5 seconds
[CHILD] hooked ACK from [77.220.184.126:80]
[CHILD] found AckNum [3091573605] and SeqNum [3105164779]
[CHILD] sending spoofed RST to [78.220.184.126:80] with SeqNum [3091573605]
[CHILD] sending RST to remote host as well with SeqNum [3105164779]
[CHILD] all done, sending USR1 signal to parent [13723] and exiting
[PARENT] received child signal, checking results...
=> success : connection has been closed !apt-get install \
libpcap0.8 \
libpcap-dev \
libnet-pcap-perl \
libyaml-perl \
libyaml-dev \
libyaml-0-1 \
-y
PERL_MM_USE_DEFAULT=1
cpan -i \
Net::RawIP \
NetPacket::Ethernet
wget http://citylan.dl.sourceforge.net/project/killcx/killcx/1.0.2/killcx-1.0.2.tgz
tar xvfz killcx-1.0.2.tgz
cd killcx-1.0.2/
cp killcx /usr/bin/
