I want to stop sending RST to specific IP( on Mac OS X.

I enter this command. But it still send RST.

sudo ipfw add drop tcp from to in tcpflags rst

What do I change this command?

  • Unfortunately you don't give any background info, but it seems you are trying to solve the wrong problem. If the system sends a RST packet, the socket which was used will be closed, thus allow no further communication. IMHO it would be better to check the application for errors and see why it sends an RST segment. – mtak Aug 18 '14 at 9:23
  • 1
    I want not to send rst packet when system receive syn ack packet. – uyreee Aug 18 '14 at 9:36
  • So why not prevent the SYN/ACK packet from coming into the system at all? This is basic configuration on all firewalls. – mtak Aug 18 '14 at 11:31
  • I try manual 3way handshake with scapy. System send rst packet before ack packet is sent. – uyreee Aug 18 '14 at 15:17

Thx for your clues.Finally,I got there.

first.add this line to /etc/pf.conf

block drop proto tcp from to flags R/R

then load the pf rules with

sudo pfctl -f /etc/pf.conf

then enable the pf rules with

sudo pfctl -e

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.