1

I am looking for a command-line TCP server (preferably a one-liner), that will listen on a specified port and when received SYN, it will not respond with SYN-ACK as usual TCP servers do.

The purpose is for testing clients trying to connect to server under heavy load for properly handling the situation.

  • 1
    What, exactly, do you want this "server" to do? Give no response whatsoever? You can get that effect with a computer that's turned off. – Scott Feb 16 '15 at 23:22
  • Yes, to give no response. But it should be listening on the port, so the client waiting for syn-ack will eventually timeout. – mirelon Feb 17 '15 at 7:13
  • 1
    A userland program won't be able to do this by itself, because once it binds to a socket, the kernel handles the TCP handshake. Two solutions that come to mind would be using kernel-level packet filtering (e.g. Linux iptables) to drop the incoming SYN, or a null route for the client to prevent them from receiving your SYN-ACK. – James Sneeringer Feb 17 '15 at 18:05
1

This is perfectly possible AFAIK. You need to bind to raw IP socket, which requires uid = 0 (but there may be a capability defined to avoid this, I don't know). This is in fact the way Portsentry works in it's stealth mode.

  • According to stackoverflow.com/questions/4988027/… a raw socket cannot be bound to a specified TCP port. Or am I missing something? – mirelon Feb 17 '15 at 21:26
  • I'm not an expert in Linux IP stack, but it makes sense. Raw socket operates in layer 3, and ports concept works in layer 4. So this is up to your daemon to read IP packets payload, get the port number from them and ignore the ones out of configured value or range. – sam_pan_mariusz Feb 17 '15 at 22:06
1

I did not find any command-line tools as your described, however, there is a workaround, iptables:

sudo iptables -A INPUT -p tcp --destination-port 52379 -j DROP
-1

You can try to use nc (netcat) with the -l option

-l      Used to specify that nc should listen for an incoming connection
        rather than initiate a connection to a remote host.  It is an
        error to use this option in conjunction with the -p, -s, or -z
        options.  Additionally, any timeouts specified with the -w option
        are ignored.

As in

nc -l yourport
  • 2
    While 'nc' is a great tool, it will not work for what the the original poster is trying to do. 'nc' will listen and accept a tcp connection... however, the original posted just wanted a way to accept SYN and not send SYN-ACK. – Arul Selvan Feb 17 '15 at 14:45
  • As per James S.'s comment on the Q, you cannot do this with a TCP oriented userland application on linux because the kernel handles the TCP/IP stack. – goldilocks Feb 17 '15 at 20:01
-1

When you don't answer with syn-ack,, the other side might continue sending syn. You could catch this by doing what port 9 does: accept (i.e. send syn-ack) and then discard all other packets. See /etc/services. It consumes a socket tho.

Another option could be blocking that ip+port in the firewall, removing the rule 60 minutes later.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.