TCPDROP(8) BSD System Manager's Manual TCPDROP(8)NAME
tcpdrop -- drop a TCP connection
SYNOPSIS
tcpdrop laddr lport faddr fport
DESCRIPTION
The tcpdrop command drops the TCP connection specified by the local address laddr, port lport and the foreign address faddr, port fport.
Addresses and ports can be specified by name or numeric value.
EXAMPLES
If a connection to httpd(8) is causing congestion on a network link, one can drop the TCP session in charge:
$ fstat | grep 'httpd.*internet.*<--'
www httpd 21307 3* internet stream tcp
0xd1007ca8 192.168.5.41:80 <-- 192.168.5.1:26747
The following command will drop the connection:
# tcpdrop 192.168.5.41 80 192.168.5.1 26747
SEE ALSO fstat(1), netstat(1)BSD June 23, 2007 BSD
Check Out this Related Man Page
TCPSPY.RULES(5) tcpspy.rules TCPSPY.RULES(5)NAME
tcpspy.rules - configuration file for tcpspy
DESCRIPTION
This file, by default /etc/tcpspy.rules, is read by the /etc/init.d/tcpspy script at init time in order to configure tcpspy (see tcpspy(8))
logger filtering rules.
It might look like:
# /etc/tcpspt.rules example
user "joedoe" and rport 22 and raddr 192.168.1.10
user 1003
lport 22 or lport 21
(lport 23 and user "joedoe") or raddr 192.168.1.20
This rules file specifies that tcpspy logs tcp connections according to 4 rules (line 1 to line 4 - one per each line) using the boolean
logic (see below) to evaluate each rule.
This particular example logs conections:
line 1 - for user "joedoe" connecting to 192.168.1.10:22 (remote)
line 2 - for user whose UID is 1003
line 3 - to localhost:22 or localhost:21
line 4 - for user "joedoe" to localhost:23 or to 192.168.1.20 (remote)
Everything from an "#" signal and the end of the line will not be evaluated.
Rule Syntax - just extracted from tcpspy(8)
A rule may be specified with the following comparison operators:
user uid
True if the local user initiating or accepting the connection has the effective user id uid.
user "username"
Same as above, but using a username instead of a user id.
lport port
True if the local end of the connection has port number port.
lport [low] - [high]
True if the local end of the connection has a port number greater than or equal to low and less than or equal to high. If the form
low- is used, high is assumed to be 65535. If the form -high is used, low is assumed to be 0. It is an error to omit both low and
high.
lport "service"
Same as above, but using a service name from /etc/services instead of a port number.
rport Same as lport but compares the port number of the remote end of the connection.
laddr n.n.n.n[/m.m.m.m]
Interpreted as a "net/mask" expression; true if "net" is equal to the bitwise AND of the local address of the connection and "mask".
If no mask is specified, a default mask with all bits set (255.255.255.255) is used.
raddr Same as laddr but compares the remote address.
exe "pattern"
True if the full filename (including directory) of the executable that created/accepted the connection matches pattern, a
glob(7)-style wildcard pattern.
The pattern "" (an empty string) matches connections created/accepted by processes whose executable filename is unknown.
If the -p option is not specified, a warning message will be printed, and the result of this comparison will always be true.
Expressions (including the comparisons listed above) may be joined together with the following logical operations:
expr1 or expr2
True if either of expr1 or expr2 are true (logical OR).
expr1 and expr2
True if both expr1 and expr2 are true (logical AND).
not expr
True if expr is false (logical NOT).
Rules are evaluated from left to right. Whitespace (space, tab and newline) characters are ignored between "words". Rules consisting of
only whitespace match no connections, but do not cause an error. Parentheses, '(' and ')' may be placed around expressions to affect the
order of evaluation.
Examples
These are some sample rules which further demonstrate how they are constructed:
user "joe" and rport "ssh"
Log connections made by user "joe" for the service "ssh".
not raddr 10.0.0.0/255.0.0.0 and rport 25 and (user "bob" or user "joe")
Log connections made by users "bob" and "joe" to remote port 25 on machines not on a fictional "intranet".
AUTHOR
Tim J. Robbins (tcpspy), Pablo Lorenzzoni (this manpage)
SEE ALSO glob(7), proc(5), services(5), signal(7), syslog(3), tcpspy(8)Spectra April 2001 TCPSPY.RULES(5)