The best option I've found is to use tcpkill
. When I installed it, it was part of the dsniff
package, so I had to install that first.
Then, you would use it like this :
$ sudo tcpkill ip host 20.129.11.86 and port 22
tcpkill: listening on eth0 [ip host 20.129.11.86 and port 22]
10.206.22.202:42532 > 20.129.11.86:22: R 1785992582:1785992582(0) win 0
10.206.22.202:42532 > 20.129.11.86:22: R 1785992732:1785992732(0) win 0
10.206.22.202:42532 > 20.129.11.86:22: R 1785993032:1785993032(0) win 0
20.129.11.86:22 > 10.206.22.202:42532: R 4065251855:4065251855(0) win 0
20.129.11.86:22 > 10.206.22.202:42532: R 4065301087:4065301087(0) win 0
20.129.11.86:22 > 10.206.22.202:42532: R 4065399551:4065399551(0) win 0
As soon tcpkill detects matching traffic, it will terminate the connection.
To see where else the IP is hitting your system, you can use netstat -aunt
and grep for the IP address. E.g.,
$ netstat -aunt | egrep 115.125.
tcp 0 0 10.20.22.25:56156 115.125.225.67:80 ESTABLISHED
tcp 0 0 10.20.22.25:42360 115.125.225.1:80 ESTABLISHED
tcp 0 0 10.20.22.25:35210 115.125.225.64:80 ESTABLISHED
Create further ufw rules if necessary.
Is restarting ssh an option?
You can use sudo /etc/init.d/sshd stop
then sudo /etc/init.d/sshd start
, or use the service mechanism:
$ sudo service ssh stop
ssh stop/waiting
$ sudo service ssh start
ssh start/running, process 4427
You could drop the interface temporarily, if that's an option.
There's an app called 'cutter' that should work, taking the IP address and port as arguments. However, I wasn't able to get the package to install correctly from
$ sudo apt-get install cutter
It's supposed to work something like this (assuming standard port 22 for ssh):
$ cutter 10.10.10.10 22
You might also check out something like the denyhosts
package.