Suppose I know that a certain ip on my local host (say 192.168.0.3) is performing an nmap scan (or executing a script) on me. Is it possible to stop the scan using tcpkill?
As I understand it,
tcpkill can kill an active TCP session. However, a port scan:
- Doesn't just use TCP, but also UDP;
- Opens a separate connection for every port it scans. It has to -- a connection is defined as between two specific IP/Port socket pairs.
- Generally doesn't do much more than a SYN/ACK handshake to see if something is listening on the port, then drops the connection and moves on to the next port.
In all likelihood, by the time you see the connection attempts in
netstat and are in a position to try to tell
tcpkill to do something about it, the portscan has already finished its job.
Blocking the IP via
iptables, either manually or automatically, strikes me as a much better bet.