I am looking for a command-line TCP server (preferably a one-liner), that will listen on a specified port and when received SYN, it will not respond with SYN-ACK as usual TCP servers do.

The purpose is for testing clients trying to connect to server under heavy load for properly handling the situation.

  • 1
    What, exactly, do you want this "server" to do? Give no response whatsoever? You can get that effect with a computer that's turned off. Feb 16, 2015 at 23:22
  • Yes, to give no response. But it should be listening on the port, so the client waiting for syn-ack will eventually timeout.
    – mirelon
    Feb 17, 2015 at 7:13
  • 1
    A userland program won't be able to do this by itself, because once it binds to a socket, the kernel handles the TCP handshake. Two solutions that come to mind would be using kernel-level packet filtering (e.g. Linux iptables) to drop the incoming SYN, or a null route for the client to prevent them from receiving your SYN-ACK. Feb 17, 2015 at 18:05

4 Answers 4


This is perfectly possible AFAIK. You need to bind to raw IP socket, which requires uid = 0 (but there may be a capability defined to avoid this, I don't know). This is in fact the way Portsentry works in it's stealth mode.

  • According to stackoverflow.com/questions/4988027/… a raw socket cannot be bound to a specified TCP port. Or am I missing something?
    – mirelon
    Feb 17, 2015 at 21:26
  • I'm not an expert in Linux IP stack, but it makes sense. Raw socket operates in layer 3, and ports concept works in layer 4. So this is up to your daemon to read IP packets payload, get the port number from them and ignore the ones out of configured value or range. Feb 17, 2015 at 22:06

I did not find any command-line tools as your described, however, there is a workaround, iptables:

sudo iptables -A INPUT -p tcp --destination-port 52379 -j DROP

You can try to use nc (netcat) with the -l option

-l      Used to specify that nc should listen for an incoming connection
        rather than initiate a connection to a remote host.  It is an
        error to use this option in conjunction with the -p, -s, or -z
        options.  Additionally, any timeouts specified with the -w option
        are ignored.

As in

nc -l yourport
  • 2
    While 'nc' is a great tool, it will not work for what the the original poster is trying to do. 'nc' will listen and accept a tcp connection... however, the original posted just wanted a way to accept SYN and not send SYN-ACK.
    – Arul
    Feb 17, 2015 at 14:45
  • As per James S.'s comment on the Q, you cannot do this with a TCP oriented userland application on linux because the kernel handles the TCP/IP stack.
    – goldilocks
    Feb 17, 2015 at 20:01

When you don't answer with syn-ack,, the other side might continue sending syn. You could catch this by doing what port 9 does: accept (i.e. send syn-ack) and then discard all other packets. See /etc/services. It consumes a socket tho.

Another option could be blocking that ip+port in the firewall, removing the rule 60 minutes later.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .