Re: iptables - drop ESTABLISHED connection

hi,
I don't think iptables is the one to do this kind of active kill of 
established connection, what you need is a packet crafting tool, such as 
hping to craft a packets with RST or FIN set as you have mentioned. 
 Alternatively you may look at IPS tools such as snort-inline although this 
is a bit overkill.
 regards,
Rick Zhong Liming
 ====================================================
Welcome to SINgapore <IN>FOSECurity Interest Group at:
www.sinfosec.org <http://www.sinfosec.org>

 On 9/1/05, roderick tapang <retapang@gmail.com> wrote: 
> hi,
>
> forgive me if this is OT for this list. :)
> i've been struggling for this since yesterday: how do i disconnect an
> ESTABLISHED connection (say an ssh session) using iptables? here's
> from ip_conntrack:
>
> tcp 6 431998 ESTABLISHED src=172.23.8.38 <http://172.23.8.38> dst=
> 172.23.229.200 <http://172.23.229.200>
> sport=41824 dport=22 packets=10 bytes=856 
> src=172.23.229.200<http://172.23.229.200>
> dst=172.23.8.38 <http://172.23.8.38> sport=22 dport=41824 packets=7 
> bytes=700 [ASSURED]
> use=1
>
> i can do this:
>
> netstat -patun | grep 172.23.8.38 <http://172.23.8.38>
>
> and then kill the PID. but i need a *graceful* way of doing it.
> its in the PREROUTING is it possible to send a FIN packet to that
> connection? or an RST maybe (which has the shortest timeout).
>
> tia.
>
> erik
> --
> roderick e. tapang, nclp
> retapang at gmail dot com
>
> (o_.' http://counter.li.org/
> //\ ----------------------
> V_/_ Linux User # 253842