Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as:

tcp        0      0 X.X.X.X:55601         X.X.X.X:https    ESTABLISHED

So, as per the man page, I enter:

$ tcpkill -i eth1 -9 port 443

The tcpkill utility outputs:

tcpkill: listening on eth1 [port 443]

...and then just hangs. After waiting for about 15 minutes, I'm not sure what's going on here.

Am I doing something wrong?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

For tcpkill to work (i.e., craft a reset packet that has the correct sequence number and source port), there must be traffic. If nothing more is printed then there is no traffic. To verify you could run tcpdump -i eth1 port 443.

share|improve this answer

I had to kill an established connection on which there was no traffic (a debug session on a JVM).

tcpkill as explained in @Mark Wagner answer could not do it, however killcx 1.0.3 (link) did (Ubuntu 10.04).

It is a perl script that has a dependency on a few libraries.

Edit

On a connection that could not be killed with killcx the combination of both tcpkill and killcx did it:

Say the connection if from LOCAL:PORTL to REMOTE:PORTR

  • In a terminal start tcpkill: tcpkill port PORTL. Tcpkill will start listening for traffic
  • In a second terminal launch killcx: killcx REMOTE:PORTR
share|improve this answer

That appears to be a HTTPS outgoing connection on port 55601 rather than a listener on 443 . I know that web browsers uisng HTTP protocol connect out on port 80 and they get return traffic in the 3000-4000 port range from the server. Your apparently trying to kill a hung HTTPS thread port from your server process?

Is TCPKILL only able to kill a listening port , such as 443, rather than a "established" response port?

share|improve this answer
1  
I think 55601 is the outgoing ephemeral port. I tried tcpkill with that as well, and get the same result. –  Charles Salvia Sep 26 '11 at 17:18
    
That's an outbound connection from ephemeral port 55601 on the local host to a remote web server listening on port 443 (https). –  joeqwerty Sep 26 '11 at 17:19
    
How about killing the PID associated with that connection? –  joeqwerty Sep 26 '11 at 17:20
    
@joeqwerty, I want to try and kill the TCP connection without stopping the process. –  Charles Salvia Sep 26 '11 at 17:25
    
@Charles: OK, gotcha. –  joeqwerty Sep 26 '11 at 17:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.