jump to navigation

tcpkill the emergency tcp connection terminator utility February 12, 2011

Posted by Tournas Dimitrios in Linux admin tools.

Tcpkill is a command line tool which comes with dsnif package to kill/terminate the tcp connections on a LAN/WAN/INTERNET from ports or hosts. To install the dsnif packages read my other post regarding the dsnif installation. It can kill in-progress tcp connections , or even run in background and wait for a specific tcp connection request to  act immediately.It’s usage can be very primitive ( kill all connections from port xx  , of from IP address , or from protocol xxx ) , to very sophisticated expressions like these used by tcpdump ( promise one of my future articles will outline tcpdump ) .

The syntax of tcpkill is : tcpkill [-i interface] [-1…9] expression

command line options
-i interface Specify the interface to listen on.
-1……-9 Specify the degree of brute force to use in killing a connection. Fast connections may require a higher number in order to land a RST in the moving receive window. Default is 3.
{expression} Specify a tcpdump-like expression to select the connection to kill

Basic example :

  • Kill all outgoing ftp (port 21) connection
    tcpkill -i eth0 port 21
  • Kill all all packets arriving at or departing from host  /(host http://www.google.com)
    tcpkill host
    tcpkill host http://www.google.com
  • Kill a specific process by it’s ID number
    tcpkill host  87654
  • To kill all IP packets between and any host except, type the following:
    tcpkill ip host and not

Practical example :

Alternative commands :

  • kill -9 $( lsof -i:80 -t )


No comments yet — be the first.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s