Re: iptables - drop ESTABLISHED connection

Ettercap may be of use for conditions that iptables is unable to
address.. CLI version would script up nicely. Just thinking aloud..

Jayson


On Wed, 2005-09-07 at 09:21 +0300, Lupu Alex wrote:
> roderick tapang wrote:
> > hi,
> >
> > forgive me if this is OT for this list. :)
> > i've been struggling for this since yesterday: how  do i disconnect an
> > ESTABLISHED connection (say an ssh session) using iptables? here's
> > from ip_conntrack:
> >
> > tcp      6 431998 ESTABLISHED src=172.23.8.38 dst=172.23.229.200
> > sport=41824 dport=22 packets=10 bytes=856 src=172.23.229.200
> > dst=172.23.8.38 sport=22 dport=41824 packets=7 bytes=700 [ASSURED]
> > use=1
> >
> > i can do this:
> >
> > netstat -patun | grep 172.23.8.38
> >
> > and then kill the PID. but i need a *graceful* way of doing it.
> > its in the PREROUTING is it possible to send a FIN packet to that
> > connection? or an RST maybe (which has the shortest timeout).
> >
> > tia.
> >
> > erik
>
>
> If you use debian, do apt-get install cutter, or else go to 
> http://www.lowth.com/cutter/software/.
>
> This is the description of the package:
> Cutter will send packets to both ends of a tcp/ip connection to close 
> the connection.  It is designed to be used on a Linux router to 
> disconnect unwanted connections.