Re: Best way to kill a live TCP connection?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tuesday 2011-01-11 13:35, Alessandro Vesely wrote:

>Hi all,
>this is clearly an overworked topic.  However, I haven't been able to
>find definitive info about it.  Please help providing more insight.
>In particular, if it is possible/convenient to design an RST injector
>that uses libnetfilter_queue and how to attach it to iptables?  (I
>would only send a RST to the local host/network.)

If you use a ruleset that emits RST for NEW connections that are picked 
up rather than SYN-new,

-m conntrack --ctstate NEW -p tcp ! --syn --dport 22 -j REJECT 
--reject-with tcp-reset

.. makes it possible to RST-kill connections using `conntrack -D`.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux