Suppose I know that a certain ip on my local host (say is performing an nmap scan (or executing a script) on me. Is it possible to stop the scan using tcpkill?



As I understand it, tcpkill can kill an active TCP session. However, a port scan:

  1. Doesn't just use TCP, but also UDP;
  2. Opens a separate connection for every port it scans. It has to -- a connection is defined as between two specific IP/Port socket pairs.
  3. Generally doesn't do much more than a SYN/ACK handshake to see if something is listening on the port, then drops the connection and moves on to the next port.

In all likelihood, by the time you see the connection attempts in netstat and are in a position to try to tell tcpkill to do something about it, the portscan has already finished its job.

Blocking the IP via iptables, either manually or automatically, strikes me as a much better bet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.