Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know about tcpdrop which is in base distribution. But this tool requires port numbers to be specified. Is there any tool to drop connections by IP?

share|improve this question
Use the packet filter pf. – Matt Dec 5 '10 at 21:16
up vote 0 down vote accepted

Well, you could use some unix tools to give you the proper tcpdrop syntax and just run it through xargs in your own script I think. Here's an ugly example, there are probably prettier ways:

netstat -an | grep $IPADDR | awk '{print $4"."$5}' | awk -F '\.' '{print $1"."$2"."$3"."$4" "$5" "$6"."$7"."$8"."$9" "$10}' | xargs tcpdrop

This uses awk to peel out the two IP/port pairs and then glue them together with a dot so you can use another awk to just spit out the desired dotted quad space port syntax.

There's probably a slicker all-in-one regex that's more clear. $IPADDR is the ip you want to drop.

share|improve this answer

BTW, newer versions of tcpdrop(1) have -a and -l flags that makes it easily "grepable":

[savetherbtz@host ~]$ tcpdrop -l -a | grep 
tcpdrop 10006 14796
tcpdrop 10006 13794
tcpdrop 10006 12996
tcpdrop 10006 12208
tcpdrop 10018 27132
tcpdrop 27132 10018
tcpdrop 10018 24355
tcpdrop 24355 10018
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.