What is tcpkill?
When managing a Linux server, you may encounter unauthorized or stuck network connections that refuse to close naturally. While firewall rules (like iptables) can block future traffic, they do not always instantly terminate established sessions. tcpkill is a command-line utility from the dsniff package that actively sniffs the network for a specific connection and injects forged TCP RST (Reset) packets, violently terminating the connection on both ends.
Step 1: Install the dsniff Package
The tcpkill utility is not included by default in most Linux distributions. You must install the dsniff suite, which contains various network auditing and penetration testing tools.
On Debian/Ubuntu:
sudo apt-get update && sudo apt-get install dsniff -y
On RHEL/CentOS (requires the EPEL repository):
sudo yum install epel-release -y
sudo yum install dsniff -y
Step 2: Identify the Connection to Terminate
Before you can kill a connection, you must know its details (IP address, port, or protocol). Use the ss or netstat command to view active connections:
sudo ss -tnp
Identify the foreign IP address or the specific port of the rogue connection you wish to drop.
Step 3: Execute tcpkill Using BPF Syntax
tcpkill uses standard Berkeley Packet Filter (BPF) syntax (the same syntax used by tcpdump) to identify the traffic it should target. You must run it with root privileges.
To kill all connections to or from a specific IP address (e.g., 192.168.1.100), run:
sudo tcpkill host 192.168.1.100
Step 4: Kill Connections by Port
If you want to terminate all connections on a specific port (for example, port 21 for FTP traffic) without affecting other services, you can filter by port number:
sudo tcpkill port 21
You can also combine filters. To kill connections between a specific host and a specific port, use the and operator:
sudo tcpkill host 10.0.0.5 and port 80
Step 5: Adjust the Aggressiveness (Optional)
By default, tcpkill uses a standard level of aggressiveness (3) when injecting RST packets. If the connection is highly resilient or operating over a latent network, you can increase the “degree” of the kill using the -9 flag (similar to the standard kill -9 command), which floods the connection with RST packets at a higher intensity.
sudo tcpkill -9 host 192.168.1.100
Once you see output indicating that tcpkill has intercepted packets, you can press Ctrl+C to stop the utility. The connection should now be dead.