Closing orphaned TCP connections is surprisingly difficult in Linux. This issue has been raised here, here, here, and here; however, neither of the approaches worked for me.

Calling close() doesn't work because there is no associated process. Installing CurrPorts won't work because I'm not on Windows. The approach of setting tcp_max_orphans to zero doesn't succeed (and I assume that even if it would, it wouldn't kill the connection immediately). Running tcpkill doesn't work because there is no active traffic. Running killcx fails with no response from child, operation may have failed. Google's tcp_killer fails with Socket not found for connection. Setting short timeout and waiting it out is not an option because I must reuse the IP and port immediately.

Throughout all of this netstat -tp persistently shows that the connection is alive:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0    156 localhost:54494         localhost:xmpp-client   FIN_WAIT1   -

What is the way to immediately kill this TCP connection?


The best solution I've come across (albeit a bit brute force), is this nice kernel module called drop-tcp-sock made by another user of the StackExchange community. It uses inet_twsk_deschedule_put() of the Linux kernel and although this function is meant to force-kill TCP connections in the TIME_WAIT state, it worked for killing FIN_WAIT1 as well.

This module can be loaded with:

git clone https://github.com/milabs/drop-tcp-sock.git
cd drop-tcp-sock && make
insmod ./drop-tcp-sock.ko

and then used (in my scenario) with:

echo "" >/proc/net/tcpdropsock

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.