Linux – way to kill an open connection without killing the process

linuxnetworkingtcp

I've search around and all the suggestions just say to kill the process. But I'm surprised I can't find any simple way to force a "connection" to close, without killing a pid associated with it.

iptables seems like a terrible solution, as i don't want add rules to block a whole service, or kill all connections. I just want to kill or force closed one existing connection, and not affect any other connections or future connections.

Ideally, the processes on both sides would see just the connection close, or at worst, stop responding.

Best Answer

If you know something about the connection (ip, host, port), you can use this command:

tcpkill host 192.168.1.2

Sources:

Related Solutions

Linux Iptables – How to Log Process Name for Outbound Connections

You could write a program to monitor /proc/net/tcp, whose output looks like this:

obi-wan ~ # cat /proc/net/tcp
  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode
   0: 00000000:0050 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 4847458 1 e6060560 300 0 0 2 -1
   1: 00000000:04D2 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 4847477 1 f2e64da0 300 0 0 2 -1
   2: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 7109 1 f2e65ac0 300 0 0 2 -1
   3: 0100007F:177A 00000000:0000 0A 00000000:00000000 00:00000000 00000000  1000        0 4864457 1 d2726540 300 0 0 2 -1
   4: 00000000:01BB 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 4847462 1 e60609c0 300 0 0 2 -1
   5: 6B00A8C0:0016 30F4B5CA:C3AB 01 00000044:00000000 01:00000031 00000000     0        0 4982752 3 f2e64940 55 4 0 2 -1
   6: 0100007F:B143 0100007F:BC5E 01 00000000:00000000 00:00000000 00000000  1000        0 2130283 1 d59cce40 21 4 1 2 -1
   7: 0100007F:BC5E 0100007F:B143 01 00000000:00000000 00:00000000 00000000  1000        0 2130285 1 d59cd2a0 21 4 0 2 -1
   8: 6B00A8C0:0016 3276C35B:8E11 01 00000000:00000000 02:000ADAB1 00000000     0        0 4982629 2 d2727260 40 4 8 2 2
   9: 6B00A8C0:0016 6500A8C0:DD5D 01 00000538:00000000 01:00000029 00000000     0        0 4864416 5 e6061b40 42 12 27 3 -1

You can then relate opened ports to inodes, which can be related back to processes and file descriptors by doing readlink on the file descriptors listed for each process:

obi-wan ~ # readlink /proc/28850/fd/3
socket:[4847458]

See here that inode 4847458 corresponds to the first tcp socket in the list above. The output of netstat -tapn verifies this for me (and recall that 0x50 == 80):

obi-wan ~ # netstat -tapn
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN     28850/cherokee-work

When the monitor program notices a change in /proc/net/tcp, parse the data and determine if the change is a newly opened socket. Then you could just enumerate all the file descriptors for each process listed in /proc, doing readlink on each on to find the matching inode. Once you find that, you have the owning pid, from which you can get anything else you might want, particularly if you have process accounting on.

If you don't need your notification to be instantaneous, then your monitor program could use a slow poll (perhaps a period of 50ms or 100ms, or even 1000ms).

Networking – dual-WAN router that can route based on protocol

I've got this working now, here's what I did:

DD-WRT does work: I started with the guide that r.tanner.f linked (http://www.dd-wrt.com/wiki/index.php/Dual_WAN_with_failover) and was able to get things working (on a Asus WL-500w). However, it wasn't particularly great: I'm not good at iptables, and as I added more rules it seemed to actually slow the device down somewhat.

After more research I discovered that the Peplink Balance line does support policy-based routing (see http://www.peplink.com/technology/load-balancing-algorithms/), and I found a used Peplink Balance 20 on eBay for about $200 (they're normally $250-$300). I got it yesterday, it took less than an hour to set it up, and it's wonderful. Here's what the policy-based routing tool looks like:

enter image description here

There's ton more power there I'm not yet using including more complex routing (e.g. "prefer satellite, but fall back to DSL", "prefer DSL but if it's saturated fall over the satellite"), QoS, etc. Another cool feature is that I can tell the device my bandwidth caps for each connection and it'll track and notify me as I start to get close.

So yeah, suffice to say I'm a big fan. Well worth the investment for me.

Best Answer

Related Solutions

Linux Iptables – How to Log Process Name for Outbound Connections

Networking – dual-WAN router that can route based on protocol

Related Question