linux使用tcpkill 杀掉不释放的连接
linux使用tcpkill 杀掉不释放的连接
当遇到TCP链接迟迟不能释放的情况，类似FIN_WAIT1、FIN_WAIT2的状态，释放时间不确定，而且对应的程序已经关闭，相应的端口也不再监听，无法通过杀进程来解决，这种情况下，为了快速恢复正常，不得不采用重启服务器的方法加以解决，Linux下可以借助dsniff包中含有tcpkill命令，该命令可以将上述状态的TCP链接加以清除
http://mirrors.zju.edu.cn/epel/6/x86_64/dsniff-2.4-0.17.b1.el6.x86_64.rpm
wget -S http://mirrors.zju.edu.cn/epel/6/x86_64/dsniff-2.4-0.17.b1.el6.x86_64.rpm
http://mirrors.zju.edu.cn/epel/6/x86_64/libnet-1.1.6-7.el6.x86_64.rpm
http://mirrors.zju.edu.cn/epel/6/x86_64/libnids-1.24-1.el6.x86_64.rpm
注意：OS环境中缺少的依赖包不一定只有libnet和libnids，根据实际情况可以去http://mirrors.zju.edu.cn/epel/6/x86_64/ 上找对应的包安装即可
也可以使用yum安装相关包：
yum search libp libICE libSM libXmu
[[email protected] app]# rpm -qpilf dsniff-2.4-0.17.b1.el6.x86_64.rpm
warning: dsniff-2.4-0.17.b1.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY
Name : dsniff Relocations: (not relocatable)
Version : 2.4 Vendor: Fedora Project
Release : 0.17.b1.el6 Build Date: 2013年12月21日 星期六 06时09分53秒
Install Date: (not installed) Build Host: buildvm-25.phx2.fedoraproject.org
Group : Applications/Internet Source RPM: dsniff-2.4-0.17.b1.el6.src.rpm
Size : 312776 License: BSD
Signature : RSA/8, 2013年12月22日 星期日 00时12分31秒, Key ID 3b49df2a0608b895
Packager : Fedora Project
URL : http://www.monkey.org/~dugsong/dsniff/
Summary : Tools for network auditing and penetration testing
Description :
A collection of tools for network auditing and penetration testing. Dsniff,
filesnarf, mailsnarf, msgsnarf, urlsnarf and webspy allow to passively monitor
a network for interesting data (passwords, e-mail, files). Arpspoof, dnsspoof
and macof facilitate the interception of network traffic normally unavailable
to an attacker (e.g, due to layer-2 switching). Sshmitm and webmitm implement
active monkey-in-the-middle attacks against redirected SSH and HTTPS sessions
by exploiting weak bindings in ad-hoc PKI.
/etc/dsniff
/etc/dsniff/dnsspoof.hosts
/etc/dsniff/dsniff.magic
/etc/dsniff/dsniff.services
/usr/sbin/arpspoof
/usr/sbin/dnsspoof
/usr/sbin/dsniff
/usr/sbin/filesnarf
/usr/sbin/macof
/usr/sbin/mailsnarf
/usr/sbin/msgsnarf
/usr/sbin/sshmitm
/usr/sbin/sshow
/usr/sbin/tcpkill
/usr/sbin/tcpnice
/usr/sbin/urlsnarf
/usr/sbin/webmitm
/usr/sbin/webspy
/usr/share/doc/dsniff-2.4
/usr/share/doc/dsniff-2.4/CHANGES
/usr/share/doc/dsniff-2.4/LICENSE
/usr/share/doc/dsniff-2.4/README
/usr/share/doc/dsniff-2.4/TODO
/usr/share/man/man8/arpspoof.8.gz
/usr/share/man/man8/dnsspoof.8.gz
/usr/share/man/man8/dsniff.8.gz
/usr/share/man/man8/filesnarf.8.gz
/usr/share/man/man8/macof.8.gz
/usr/share/man/man8/mailsnarf.8.gz
/usr/share/man/man8/msgsnarf.8.gz
/usr/share/man/man8/sshmitm.8.gz
/usr/share/man/man8/sshow.8.gz
/usr/share/man/man8/tcpkill.8.gz
/usr/share/man/man8/tcpnice.8.gz
/usr/share/man/man8/urlsnarf.8.gz
/usr/share/man/man8/webmitm.8.gz
/usr/share/man/man8/webspy.8.gz
[[email protected] app]#
[[email protected] app]# cat /etc/redhat-release
CentOS release 6.6 (Final)
[[email protected] app]#
[[email protected] app]# rpm -ivh dsniff-2.4-0.17.b1.el6.x86_64.rpm
warning: dsniff-2.4-0.17.b1.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY
error: Failed dependencies:
libICE.so.6()(64bit) is needed by dsniff-2.4-0.17.b1.el6.x86_64
libSM.so.6()(64bit) is needed by dsniff-2.4-0.17.b1.el6.x86_64
libXmu.so.6()(64bit) is needed by dsniff-2.4-0.17.b1.el6.x86_64
libnet.so.1()(64bit) is needed by dsniff-2.4-0.17.b1.el6.x86_64
libnids.so.1.24()(64bit) is needed by dsniff-2.4-0.17.b1.el6.x86_64
libpcap.so.1()(64bit) is needed by dsniff-2.4-0.17.b1.el6.x86_64
[[email protected] app]#
[[email protected] app]# rpm -qpilf libnet-1.1.6-7.el6.x86_64.rpm
warning: libnet-1.1.6-7.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY
Name : libnet Relocations: (not relocatable)
Version : 1.1.6 Vendor: Fedora Project
Release : 7.el6 Build Date: 2013年12月21日 星期六 07时21分45秒
Install Date: (not installed) Build Host: buildvm-05.phx2.fedoraproject.org
Group : System Environment/Libraries Source RPM: libnet-1.1.6-7.el6.src.rpm
Size : 144734 License: BSD
Signature : RSA/8, 2013年12月22日 星期日 00时12分25秒, Key ID 3b49df2a0608b895
Packager : Fedora Project
URL : http://www.sourceforge.net/projects/libnet-dev/
Summary : C library for portable packet creation and injection
Description :
Libnet is an API to help with the construction and handling of network
packets. It provides a portable framework for low-level network packet
writing and handling (use libnet in conjunction with libpcap and you can
write some really cool stuff). Libnet includes packet creation at the IP
layer and at the link layer as well as a host of supplementary and
complementary functionality.
/lib64/libnet.so.1
/lib64/libnet.so.1.7.0
/usr/share/doc/libnet-1.1.6
/usr/share/doc/libnet-1.1.6/CHANGELOG
/usr/share/doc/libnet-1.1.6/CONTRIB
/usr/share/doc/libnet-1.1.6/COPYING
/usr/share/doc/libnet-1.1.6/README
[[email protected] app]#
[[email protected] app]# rpm -qpilf libnids-1.24-1.el6.x86_64.rpm
warning: libnids-1.24-1.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY
Name : libnids Relocations: (not relocatable)
Version : 1.24 Vendor: Fedora Project
Release : 1.el6 Build Date: 2010年05月20日 星期四 04时53分15秒
Install Date: (not installed) Build Host: x86-04.phx2.fedoraproject.org
Group : System Environment/Libraries Source RPM: libnids-1.24-1.el6.src.rpm
Size : 74467 License: GPLv2+
Signature : RSA/8, 2010年05月20日 星期四 19时34分42秒, Key ID 3b49df2a0608b895
Packager : Fedora Project
URL : http://libnids.sourceforge.net/
Summary : Implementation of an E-component of Network Intrusion Detection System
Description :
Libnids is an implementation of an E-component of Network Intrusion
Detection System. It emulates the IP stack of Linux 2.x and offers
IP defragmentation, TCP stream assembly and TCP port scan detection.
Using libnids, one has got a convenient access to data carried by a
TCP stream, no matter how artfully obscured by an attacker.
/usr/lib64/libnids.so.1.24
/usr/share/doc/libnids-1.24
/usr/share/doc/libnids-1.24/CHANGES
/usr/share/doc/libnids-1.24/COPYING
/usr/share/doc/libnids-1.24/CREDITS
/usr/share/doc/libnids-1.24/MISC
/usr/share/doc/libnids-1.24/README
[[email protected] app]#
[[email protected] app]# rpm -ivh libnet-1.1.6-7.el6.x86_64.rpm
warning: libnet-1.1.6-7.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY
Preparing... ########################################### [100%]
1:libnet ########################################### [100%]
[[email protected] app]# rpm -ivh libnids-1.24-1.el6.x86_64.rpm
warning: libnids-1.24-1.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY
error: Failed dependencies:
libpcap.so.1()(64bit) is needed by libnids-1.24-1.el6.x86_64
[[email protected] app]#
[[email protected] app]# yum install libpcap.x86_64 libICE.x86_64 libSM.x86_64 libXmu.x86_64
已加载插件：fastestmirror
设置安装进程
Loading mirror speeds from cached hostfile
解决依赖关系
--> 执行事务检查
---> Package libICE.x86_64 0:1.0.6-1.el6 will be 安装
---> Package libSM.x86_64 0:1.2.1-2.el6 will be 安装
---> Package libXmu.x86_64 0:1.1.1-2.el6 will be 安装
--> 处理依赖关系 libXt.so.6()(64bit)，它被软件包 libXmu-1.1.1-2.el6.x86_64 需要
--> 处理依赖关系 libXext.so.6()(64bit)，它被软件包 libXmu-1.1.1-2.el6.x86_64 需要
---> Package libpcap.x86_64 14:1.4.0-1.20130826git2dbcaa1.el6 will be 安装
--> 执行事务检查
---> Package libXext.x86_64 0:1.3.2-2.1.el6 will be 安装
---> Package libXt.x86_64 0:1.1.4-6.1.el6 will be 安装
--> 完成依赖关系计算
依赖关系解决
=============================================================================================================================================================================================================================================
软件包 架构 版本 仓库 大小
=============================================================================================================================================================================================================================================
正在安装:
libICE x86_64 1.0.6-1.el6 gomeo2o 53 k
libSM x86_64 1.2.1-2.el6 gomeo2o 37 k
libXmu x86_64 1.1.1-2.el6 gomeo2o 66 k
libpcap x86_64 14:1.4.0-1.20130826git2dbcaa1.el6 gomeo2o 130 k
为依赖而安装:
libXext x86_64 1.3.2-2.1.el6 gomeo2o 35 k
libXt x86_64 1.1.4-6.1.el6 gomeo2o 165 k
事务概要
=============================================================================================================================================================================================================================================
Install 6 Package(s)
总下载量：485 k
Installed size: 1.1 M
确定吗？[y/N]：y
下载软件包：
(1/6): libICE-1.0.6-1.el6.x86_64.rpm | 53 kB 00:00
(2/6): libSM-1.2.1-2.el6.x86_64.rpm | 37 kB 00:00
(3/6): libXext-1.3.2-2.1.el6.x86_64.rpm | 35 kB 00:00
(4/6): libXmu-1.1.1-2.el6.x86_64.rpm | 66 kB 00:00
(5/6): libXt-1.1.4-6.1.el6.x86_64.rpm | 165 kB 00:00
(6/6): libpcap-1.4.0-1.20130826git2dbcaa1.el6.x86_64.rpm | 130 kB 00:00
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
总计 4.4 MB/s | 485 kB 00:00
运行 rpm_check_debug
执行事务测试
事务测试成功
执行事务
Warning: RPMDB altered outside of yum.
正在安装 : libICE-1.0.6-1.el6.x86_64 1/6
正在安装 : libSM-1.2.1-2.el6.x86_64 2/6
正在安装 : libXt-1.1.4-6.1.el6.x86_64 3/6
正在安装 : libXext-1.3.2-2.1.el6.x86_64 4/6
正在安装 : libXmu-1.1.1-2.el6.x86_64 5/6
正在安装 : 14:libpcap-1.4.0-1.20130826git2dbcaa1.el6.x86_64 6/6
Verifying : libXext-1.3.2-2.1.el6.x86_64 1/6
Verifying : libXt-1.1.4-6.1.el6.x86_64 2/6
Verifying : 14:libpcap-1.4.0-1.20130826git2dbcaa1.el6.x86_64 3/6
Verifying : libICE-1.0.6-1.el6.x86_64 4/6
Verifying : libSM-1.2.1-2.el6.x86_64 5/6
Verifying : libXmu-1.1.1-2.el6.x86_64 6/6
已安装:
libICE.x86_64 0:1.0.6-1.el6 libSM.x86_64 0:1.2.1-2.el6 libXmu.x86_64 0:1.1.1-2.el6 libpcap.x86_64 14:1.4.0-1.20130826git2dbcaa1.el6
作为依赖被安装:
libXext.x86_64 0:1.3.2-2.1.el6 libXt.x86_64 0:1.1.4-6.1.el6
完毕！
[[email protected] app]#
[[email protected] app]# rpm -ivh libnids-1.24-1.el6.x86_64.rpm
warning: libnids-1.24-1.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY
Preparing... ########################################### [100%]
1:libnids ########################################### [100%]
[[email protected] app]#
[[email protected] app]# rpm -ivh dsniff-2.4-0.17.b1.el6.x86_64.rpm
warning: dsniff-2.4-0.17.b1.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY
Preparing... ########################################### [100%]
1:dsniff ########################################### [100%]
[[email protected] app]#
服务端：
[[email protected] app]# python socketserver.py
get value 1
send welcome
get value 2
send refuse
get value 1
send welcome
^CTraceback (most recent call last):
File "socketserver.py", line 12, in <module>
buf = connection.recv(2048)
KeyboardInterrupt
[[email protected] app]# python socketserver.py
Traceback (most recent call last):
File "socketserver.py", line 6, in <module>
sock.bind(('0.0.0.0',9999))
File "<string>", line 1, in bind
socket.error: [Errno 98] Address already in use
[[email protected] app]#
[[email protected] app]# python socketserver.py
客户端：
[[email protected] app]# python socketclient.py
sock <socket._socketobject object at 0x7f620ae1fc90>
send to server with value: 1
sock.recv welcome to server !!!
sock <socket._socketobject object at 0x7f620ae1fd00>
send to server with value: 2
sock.recv please go away
sock <socket._socketobject object at 0x7f620ae1fc90>
send to server with value: 1
sock.recv welcome to server !!!
sock <socket._socketobject object at 0x7f620ae1fd00>
send to server with value: 2
sock.recv
[Errno 111] Connection refused
Failed to create socket. Error code: 111 , Error message : Connection refused
Traceback (most recent call last):
File "socketclient.py", line 17, in <module>
raise Exception('SOCKET ERROR:' + str(e))
Exception: SOCKET ERROR:[Errno 111] Connection refused
[[email protected] app]#
连接监控记录:
当服务端被我强制关闭后连接变成了CLOSE_WAIT状态 立即启动服务端报：socket.error: [Errno 98] Address already in use
（不过我这里连接释放比较快没有使用到tcpkill）
[[email protected] app]# while true;do netstat -alnpt|grep python|grep 9999;sleep 1;echo --------------------;done
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
tcp 0 0 10.144.5.223:9999 10.144.5.223:37096 ESTABLISHED 15897/python
tcp 0 0 10.144.5.223:37096 10.144.5.223:9999 ESTABLISHED 15922/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
tcp 0 0 10.144.5.223:9999 10.144.5.223:37096 ESTABLISHED 15897/python
tcp 0 0 10.144.5.223:37096 10.144.5.223:9999 ESTABLISHED 15922/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
tcp 0 0 10.144.5.223:37097 10.144.5.223:9999 ESTABLISHED 15922/python
tcp 0 0 10.144.5.223:9999 10.144.5.223:37097 ESTABLISHED 15897/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
tcp 0 0 10.144.5.223:37097 10.144.5.223:9999 ESTABLISHED 15922/python
tcp 0 0 10.144.5.223:9999 10.144.5.223:37097 ESTABLISHED 15897/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
tcp 0 0 10.144.5.223:9999 10.144.5.223:37098 ESTABLISHED 15897/python
tcp 0 0 10.144.5.223:37098 10.144.5.223:9999 ESTABLISHED 15922/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15897/python
tcp 0 0 10.144.5.223:9999 10.144.5.223:37098 ESTABLISHED 15897/python
tcp 0 0 10.144.5.223:37098 10.144.5.223:9999 ESTABLISHED 15922/python
--------------------
tcp 1 0 10.144.5.223:37099 10.144.5.223:9999 CLOSE_WAIT 15922/python
--------------------
tcp 1 0 10.144.5.223:37099 10.144.5.223:9999 CLOSE_WAIT 15922/python
--------------------
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15976/python
--------------------
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 15976/python
^C
[[email protected] app]#