Take the 2-minute tour ×

I know about tcpdrop which is in base distribution. But this tool requires port numbers to be specified. Is there any tool to drop connections by IP?

share|improve this question
Use the packet filter pf. –  Matt Dec 5 '10 at 21:16
add comment

2 Answers

up vote 0 down vote accepted

Well, you could use some unix tools to give you the proper tcpdrop syntax and just run it through xargs in your own script I think. Here's an ugly example, there are probably prettier ways:

netstat -an | grep $IPADDR | awk '{print $4"."$5}' | awk -F '\.' '{print $1"."$2"."$3"."$4" "$5" "$6"."$7"."$8"."$9" "$10}' | xargs tcpdrop

This uses awk to peel out the two IP/port pairs and then glue them together with a dot so you can use another awk to just spit out the desired dotted quad space port syntax.

There's probably a slicker all-in-one regex that's more clear. $IPADDR is the ip you want to drop.

share|improve this answer
add comment

BTW, newer versions of tcpdrop(1) have -a and -l flags that makes it easily "grepable":

[savetherbtz@host ~]$ tcpdrop -l -a | grep 
tcpdrop 10006 14796
tcpdrop 10006 13794
tcpdrop 10006 12996
tcpdrop 10006 12208
tcpdrop 10018 27132
tcpdrop 27132 10018
tcpdrop 10018 24355
tcpdrop 24355 10018
share|improve this answer
add comment

Your Answer


