kill ?
vermouth 发表于 2010-08-09 13:41
#hping2 192.168.1.50 -R -s 55692 -p 22 -a 192.168.1.176 -M 1876579253 -L 0 -k -c 1
目的IP： 192.168.1.50
-s 55692 ： 源端口
-p 22： 目的端口
-a 192.168.1.176： 伪造的源IP。也就是已建立链接的源IP地址
-M 1876579253 ：指定序列号，源IP方向上的序列号
-L 0 ： RST包，ack_seq置为0
-k ： 使用固定源端口
-c 1 ： 发送1个数据包
kill ?
vermouth 发表于 2010-08-09 13:41
记得 hping 好像可以解决类似的问题，但忘记是解决 TCP socket 问题还是 conntrack 问题了，反正是可以断掉 ...
platinum 发表于 2010-08-09 13:53
http://linux.chinaunix.net/bbs/thread-591634-1-1.html
记得 hping 好像可以解决类似的问题，但忘记是解决 TCP socket 问题还是 conntrack 问题了，反正是可以断掉 ...
platinum 发表于 2010-08-09 13:53
#!/bin/bash
echo
echo "############################"
echo "# Edit by Youngh 2003.06.24 v1.1 "
echo "# Usage : clr_conns IpAddress"
echo "# This will clear all connections from this IP_Address"
echo "# Example:/root/clr_conns 10.0.3.3 "
echo "############################"
echo
if [ -z $1 ] ; then
exit
fi
grep -E "^tcp .{10,25}ESTABLISHED src=$1 " /proc/net/ip_conntrack | while read line ; do
S_IP=`echo $line | awk '{print substr($5,5)}'`
S_SOCK=`echo $line | awk '{print substr($7,7)}'`
D_IP=`echo $line | awk '{print substr($6,5)}'`
D_SOCK=`echo $line | awk '{print substr($8,7)}'`
echo "$S_IP:$S_SOCK $D_IP:$D_SOCK"
hping2 $D_IP -R -s $S_SOCK -p $D_SOCK -a $S_IP -k -c 1 >/dev/null 2> /dev/null &
done
[root@Godbach hping2-rc2]# cat /proc/net/ip_conntrack | grep 192.168.6.49
tcp 6 431699 ESTABLISHED src=192.168.6.49 dst=192.168.6.50 sport=3232 dport=22 packets=65 bytes=5695 src=192.168.6.50 dst=192.168.6.49 sport=22 dport=3232 packets=66 bytes=9752 [ASSURED] mark=0 secmark=0 use=1
tcp 6 428378 ESTABLISHED src=192.168.6.49 dst=192.168.6.50 sport=3228 dport=22 packets=26 bytes=2783 src=192.168.6.50 dst=192.168.6.49 sport=22 dport=3228 packets=32 bytes=4284 [ASSURED] mark=0 secmark=0 use=1
[root@Godbach hping2-rc2]# ./hping2 192.168.6.50 -R -s 3228 -p 22 -a 192.168.6.49 -k -c 1
HPING 192.168.6.50 (eth0 192.168.6.50): R set, 40 headers + 0 data bytes
--- 192.168.6.50 hping statistic ---
1 packets tramitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms
[root@Godbach hping2-rc2]# cat /proc/net/ip_conntrack | grep 192.168.6.49
tcp 6 431668 ESTABLISHED src=192.168.6.49 dst=192.168.6.50 sport=3232 dport=22 packets=65 bytes=5695 src=192.168.6.50 dst=192.168.6.49 sport=22 dport=3232 packets=66 bytes=9752 [ASSURED] mark=0 secmark=0 use=1
tcp 6 428347 ESTABLISHED src=192.168.6.49 dst=192.168.6.50 sport=3228 dport=22 packets=26 bytes=2783 src=192.168.6.50 dst=192.168.6.49 sport=22 dport=3228 packets=32 bytes=4284 [ASSURED] mark=0 secmark=0 use=1
[root@Godbach hping2-rc2]#
-M --setseq set TCP sequence number
-L --setack set TCP ack
杨华 youngh0702@21cn.com
Wed, 25 Jun 2003 11:06:53 +0800
* Previous message: clear the ip_conntrack entry
* Next message: clear the ip_conntrack entry
* Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Hi everyone :
I have notice that many request about how to clear the
/proc/net/ip_conntrack entry , and someone suggest that it have no
resolution except restart the interface .
I think the answer : send a fake ip packet (with RST set) to
firewall , to let it think the connection terminate .
By this methode , I have the following script written , it work
well for me.
To use this script , you must have hping2 installed , it can be
download from http://www.hping.org
--------- clr_conns start ------------------
echo
echo "############################"
echo "# Edit by Youngh 2003.06.24 v1.1 "
echo "# Usage : clr_conns IpAddress"
echo "# This will clear all connections from this IP_Address"
echo "# Example:/root/clr_conns 10.0.3.3 "
echo "############################"
echo
if [ -z $1 ] ; then
exit
fi
grep -E "^tcp .{10,25}ESTABLISHED src=$1 " /proc/net/ip_conntrack | while read line ; do
S_IP=`echo $line | awk '{print substr($5,5)}'`
S_SOCK=`echo $line | awk '{print substr($7,7)}'`
D_IP=`echo $line | awk '{print substr($6,5)}'`
D_SOCK=`echo $line | awk '{print substr($8,7)}'`
echo "$S_IP:$S_SOCK $D_IP:$D_SOCK"
hping2 $D_IP -R -s $S_SOCK -p $D_SOCK -a $S_IP -k -c 1 >/dev/null 2>/dev/null &
done
----------------clr_conns end --------------------------------
，tcp established状态默认要5天才timeout。
回复 Godbach
怎么获得连接的序列号?
heidern 发表于 2010-08-13 09:54
struct nf_conn
{
......
/* Storage reserved for other modules: */
union nf_conntrack_proto proto;
/* Extensions */
struct nf_ct_ext *ext;
};
/* per conntrack: protocol private data */
union nf_conntrack_proto {
/* insert conntrack proto private data here */
struct ip_ct_sctp sctp;
struct ip_ct_tcp tcp;
struct ip_ct_icmp icmp;
struct nf_ct_icmpv6 icmpv6;
struct nf_ct_gre gre;
};
struct ip_ct_tcp
{
struct ip_ct_tcp_state seen[2]; /* connection parameters per direction */
u_int8_t state; /* state of the connection (enum tcp_conntrack) */
/* For detecting stale connections */
u_int8_t last_dir; /* Direction of the last packet (enum ip_conntrack_dir) */
u_int8_t retrans; /* Number of retransmitted packets */
u_int8_t last_index; /* Index of the last packet */
u_int32_t last_seq; /* Last sequence number seen in dir */
u_int32_t last_ack; /* Last sequence number seen in opposite dir */
u_int32_t last_end; /* Last seq + len */
u_int16_t last_win; /* Last window advertisement seen in dir */
};
TCP PROBE MODE:
-g, --source-port <portnumber> : Set source port.
-p, --dest-port <port spec> : Set destination port(s).
--seq <seqnumber> : Set sequence number.
--flags <flag list> : Set TCP flags (ACK,PSH,RST,SYN,FIN...)
--ack <acknumber> : Set ACK number.
--win <size> : Set window size.
--badsum : Use a random invalid checksum.
通过 conn 里面的 tcp 状态来找到 seq，需要启用 conn 才可以
但有些环境是不能启用 conntrack 的，否则会 ...
platinum 发表于 2010-08-16 11:22
嗯，白金兄说的这个问题是需要注意。
如果不利用conn的话，则需要考虑直接从tcp的那个全局sock变量中获取 ...
Godbach 发表于 2010-08-16 11:37
| 欢迎光临 Chinaunix (http://bbs.chinaunix.net/) | Powered by Discuz! X3.2 |
