Linux: Force Close A Socket / Port On Server In a TIME_WAIT State

I run a BT client and few other server program on Linux. Sometime these programs get overloaded with too many connections and crashes. If I restart my apps, I see lots of old IPs in a TIME_WAIT state. How do I force and and close everything in a TIME_WAIT state under Linux operating systems?
TIME-WAIT state can exists on either server or client program. It represents waiting for enough time to pass to be sure the remote TCP received the acknowledgment of its connection termination request.

The/proc/sys/net/ipv4/tcp_fin_timeout setting determines the time that must elapse before TCP/IP can release a closed connection and reuse its resources. This is known as TIME_WAIT state. TIME_WAIT is a normal part of the TCP connection. However, if you must close a socket in TIME_WAIT state, try:

[a] Restart the networking service

[b] cutter command

Finding out current TIME_WAIT settings

Type the following command
$ cat /proc/sys/net/ipv4/tcp_fin_timeout
Sample outputs:

60

You can lower the value by typing the following command as root user:
# echo 20 > /proc/sys/net/ipv4/tcp_fin_timeout
To set /proc/sys/net/ipv4/tcp_fin_timeout to 20 permanently, edit the file/etc/sysctl.conf and set it as follows:

net.ipv4.tcp_fin_timeout=20

Restating the network service

To restart the network service under RHEL / CentOS based systems, enter:
# service network restart
OR
# /etc/init.d/network restart
Ubuntu / Debian Linux, user try the following command:
$ sudo service networking restart
OR
$ sudo /etc/init.d/networking restart

cutter command

Cutter is an open source program that allows Linux firewall administrators to abort TCP/IP connections routed over the firewall or router on which it is run.

Examples

To cut all connections from 192.168.1.10 to server, enter:
# cutter 192.168.1.5
To cut all ssh connection from 192.168.1.1 to server, type:
# cutter 192.168.1.5 22
To cut all http connection from 192.168.1.5 to ssh server 202.54.1.20, run:
# cutter 202.54.1.20 192.168.1.5 80
See below for 'how to install and use the cutter command' for more information here.

Linux Cutting the tcp/ip network connection with cutter command

by NIXCRAFT on DECEMBER 9, 2005 · 14 COMMENTS· LAST UPDATED SEPTEMBER 29, 2007

Recently I came across very powerful and nifty tool called cutter. Just imagine that people in your private network using peer to peer (P2P) software such as Kazaa, iMesh or others and you want to cut them or just want to cut all ftp connection over your firewall but not all traffic to host. Network security administrators sometimes need to be able to abort TCP/IP connections routed over their firewalls on demand

cutter utility

In the following sample network diagram client workstation 192.168.1.1 sending ftp, http, ssh traffic using 192.168.1.254 (Linux based) router to server outside our network, and you would like to cut ftp traffic without interrupting other connection? So how do you block and cut traffic? Simply, use cutter utility.

client ->    Linux firewall -> Internet --> Servers
FTP    ->    192.168.1.254  -> Internet --> FTP Server
HTTP   ->    192.168.1.254  -> Internet --> HTTP Server
SSH    ->    192.168.1.254  -> Internet --> SSH Server
192.168.1.1

Cutter is an open source program that allows Linux firewall administrators to abort TCP/IP connections routed over Linux based firewall. This tool is very handy in situation like:

• To terminate connection such as SSH tunnels or VPNs left by your own users
• To abort crackers attacks as soon as they detected
• To kill high bandwidth consuming connection
• To kill peer-to-peer traffic etc

How do I use cutter command?

Use apt-get to install cutter on a Debian / Ubuntu Linux firewall:
# apt-get install cutter

1) Login to your iptables based firewall router

2) Identify your internal connection (use netstat or tcpdump)

3) Use cutter the command as follows:
cutter {IP-address} {Port}

Examples:
Cut all connections from 192.168.1.5 to server
# cutter 192.168.1.5

Cut all ssh connection from 192.168.1.5 to server
# cutter 192.168.1.5 22

Cut all ssh connection from 192.168.1.5 to ssh server 202.54.1.20
# cutter 202.54.1.20 192.168.1.5 22

Please note that cutter has been designed for use as a administrators tool for Linux firewalls do not use this tool for malicious purpose. For more information about this tool & how actually it works by sending FIN -> ACK -> RST sequence of packets to terminate connection, see theofficial web site.

Update: As pointed out by Mina Naguib you can also use tcpkill command for same purpose.

SEE ALSO

See the following man pages:
man 7 socket
man 7 tcp
man 7 ip
man 5 proc