I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as:

tcp        0      0 X.X.X.X:55601         X.X.X.X:https    ESTABLISHED

So, as per the man page, I enter:

$ tcpkill -i eth1 -9 port 443

The tcpkill utility outputs:

tcpkill: listening on eth1 [port 443]

...and then just hangs. After waiting for about 15 minutes, I'm not sure what's going on here.

Am I doing something wrong?


For tcpkill to work (i.e., craft a reset packet that has the correct sequence number and source port), there must be traffic. If nothing more is printed then there is no traffic. To verify you could run tcpdump -i eth1 port 443.


I had to kill an established connection on which there was no traffic (a debug session on a JVM).

tcpkill as explained in @Mark Wagner answer could not do it, however killcx 1.0.3 (link) did (Ubuntu 10.04).

It is a perl script that has a dependency on a few libraries.


On a connection that could not be killed with killcx the combination of both tcpkill and killcx did it:

Say the connection if from LOCAL:PORTL to REMOTE:PORTR

  • In a terminal start tcpkill: tcpkill port PORTL. Tcpkill will start listening for traffic
  • In a second terminal launch killcx: killcx REMOTE:PORTR

That appears to be a HTTPS outgoing connection on port 55601 rather than a listener on 443 . I know that web browsers uisng HTTP protocol connect out on port 80 and they get return traffic in the 3000-4000 port range from the server. Your apparently trying to kill a hung HTTPS thread port from your server process?

Is TCPKILL only able to kill a listening port , such as 443, rather than a "established" response port?

  • 1
    I think 55601 is the outgoing ephemeral port. I tried tcpkill with that as well, and get the same result. – Charles Salvia Sep 26 '11 at 17:18
  • That's an outbound connection from ephemeral port 55601 on the local host to a remote web server listening on port 443 (https). – joeqwerty Sep 26 '11 at 17:19
  • How about killing the PID associated with that connection? – joeqwerty Sep 26 '11 at 17:20
  • @joeqwerty, I want to try and kill the TCP connection without stopping the process. – Charles Salvia Sep 26 '11 at 17:25
  • @Charles: OK, gotcha. – joeqwerty Sep 26 '11 at 17:26

Y'all are way overthinking it, try this.


# pass ip in on command line
tcpkill host $1 &
sleep 9
pkill tcpkill

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.