HowTo: Kill TCP Connections in CLOSE_WAIT State

HowTo: Kill TCP Connections in CLOSE_WAIT State

 

If you are seeing a large number of connections persisting in CLOSE_WAIT state, it’s probably a problem with the application itself.

Restarting it will clear the connections temporarily, but obviously, further investigation will be required to find the cause of the problem.

If restarting of application is undesirable, you can manually kill all connections that are in CLOSE_WAIT state.

Kill CLOSE_WAIT connections by IP

Kill TCP connections in CLOSE_WAIT state, established with the foreign IP address 192.168.0.100:

$ netstat -anp |\
grep 192.168.0.100 |\
grep CLOSE_WAIT |\
awk '{print $7}' |\
cut -d \/ -f1 |\
grep -oE "[[:digit:]]{1,}" |\
xargs kill

The same command in one line:

$ netstat -anp | grep 192.168.0.100 | grep CLOSE_WAIT | awk '{print $7}' | cut -d \/ -f1 | grep -oE "[[:digit:]]{1,}" | xargs kill

Kill CLOSE_WAIT connections by PORT

Use the following command to Kill TCP connections in CLOSE_WAIT state on port 80:

$ netstat -anp |\
grep ':80 ' |\
grep CLOSE_WAIT |\
awk '{print $7}' |\
cut -d \/ -f1 |\
grep -oE "[[:digit:]]{1,}" |\
xargs kill

The same command in one line:

$ netstat -anp | grep ':80 ' | grep CLOSE_WAIT | awk '{print $7}' | cut -d \/ -f1 | grep -oE "[[:digit:]]{1,}" | xargs kill

Kill CLOSE_WAIT connections by IP and PORT

Kill TCP connections in CLOSE_WAIT, state established with foreign IP address 192.168.0.100 on port 80:

$ netstat -anp |\
grep 192.168.0.100 |\
grep ':80 ' |\
grep CLOSE_WAIT |\
awk '{print $7}' |\
cut -d \/ -f1 |\
grep -oE "[[:digit:]]{1,}" |\
xargs kill

The same command in one line:

$ netstat -anp | grep 192.168.0.100 | grep ':80 ' | grep CLOSE_WAIT | awk '{print $7}' | cut -d \/ -f1 | grep -oE "[[:digit:]]{1,}" | xargs kill

How Does It Work?

$ netstat -anp |\  # print network connections
grep 192.168.0.100 |\  # established with IP 192.168.0.100
grep ':80 ' |\  # established on port 80
grep CLOSE_WAIT |\  #  connections in CLOSE_WAIT state
awk '{print $7}' |\  #  print the 7th column
cut -d \/ -f1 |\  #  extract PIDs
grep -oE "[[:digit:]]{1,}" |\  #  extract PIDs
xargs kill  #  kill PIDs

lsof -i :80 |grep CLOSE_WAIT| awk '{print $2}|uniq| xargs kill
 
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
10 nmap Commands Every Sysadmin Should Know
Viewed 7687 times since Wed, May 22, 2019
ZPOOL: Grow a zpool by adding new device(s)
Viewed 4044 times since Sun, Jun 3, 2018
LVM: Extend an existing Volume Group by adding a new disk
Viewed 1016 times since Sat, Jun 2, 2018
RHEL: Forgotten ’root’ password / using single-user to gain access
Viewed 4698 times since Sat, Jun 2, 2018
Linux ssh Hide OpenSSH Version Banner
Viewed 12922 times since Wed, Apr 22, 2020
Improve security with polyinstantiation
Viewed 10665 times since Fri, May 15, 2020
How To: Create Self-Signed Certificate – OpenSSL
Viewed 1381 times since Mon, Feb 18, 2019
Epoch & Unix Timestamp Conversion Tools
Viewed 30445 times since Fri, Jun 22, 2018
sed Delete / Remove ^M Carriage Return (Line Feed / CRLF) on Linux or Unix
Viewed 6865 times since Thu, Feb 7, 2019
Top 20 OpenSSH Server Best Security Practices ssh linux aix
Viewed 4533 times since Fri, May 15, 2020