linux - Manually closing a port from commandline

23
2014-04
  • Questioner

    I want to close an open port which is in listening mode between my client and server application.

    Is there any manual command line option in Linux to close a port ??

    NOTE: I came to know that "only the application which owns the connected socket should close it, which will happen when the application terminates."

    I dont understand why it is only possible by the application which opens it ... But still eager to know if there is any another way to do it ??

  • Answers
  • Will

    You're kind of asking the wrong question here. It isn't really possible to simply "close a port" from outside the application that opened the socket listening on it. The only way to do this is to completely kill the process that owns the port. Then, in about a minute or two, the port will become available again for use. Here's what's going on (if you don't care, skip to the end where I show you how to kill the process owning a particular port):

    Ports are resources allocated by the OS to different processes. This is similar to asking the OS for a file pointer. However, unlike file pointers, only ONE process at a time may own a port. Through the BSD socket interface, processes can make a request to listen on a port, which the OS will then grant. The OS will also make sure no other process gets the same port. At any point, the process can release the port by closing the socket. The OS will then reclaim the port. Alternatively, if the process ends without releasing the port, the OS will eventually reclaim the port (though it won't happen immediately: it'll take a few minutes).

    Now, what you want to do (simply close the port from the command-line), isn't possible for two reasons. First, if it were possible, it would mean one process could simply steal away another process's resource (the port). This would be bad policy, unless restricted to privileged processes. The second reason is it is unclear what would happen to the process that owned the port if we let it continue running. The process's code is written assuming that it owns this resource. If we simply took it away, it would end up crashing on it's own, so OS's don't let you do this, even if you're a privileged process. Instead, you must simply kill them.

    Anyway, here's how to kill a process that owns a particular port:

    sudo netstat -ap | grep :<port_number>
    

    That will output the line corresponding to the process holding port . Then, look in the last column, you'll see /. Then execute this:

    kill  <pid>
    

    If that doesn't work (you can check by re-running the netstat command). Do this:

    kill -9 <pid>
    

    In general, it's better to avoid sending SIGKILL if you can. This is why I tell you to try kill before kill -9. Just using kill sends the gentler SIGTERM.

    Like I said, it will still take a few minutes for the port to re-open if you do this. I don't know a way to speed this up. If someone else does, I'd love to hear it.

  • Dankó Dávid

    I had same problem, the process must keep alive but the socket must close. Closing a socket in a running process is not impossible but difficult: 1) locate the process :

    netstat -np
    

    You get a source/destination ip:port portstate pid/processname map

    2) locate the the socket's file descriptor in the process

    lsof -np $pid
    

    You get a list: process name, pid, user,fileDescriptor, ... a connection string.

    Locate the matching fileDescriptor number for the connection.

    Now connect the process:

    gdb -p $pid
    

    3) Now close the socket:

    call close($fileDescritor)
    

    //does not need ; at end.

    Than detach:

    quit
    

    And the socket is closed.

  • Community

    You could alternatively use iptables:

    iptables -I INPUT -p tcp --dport 80 -j DROP
    

    It basically accomplishes what you want. This will drop all TCP traffic to port 80.

  • Ben
    netstat -anp | grep 80
    

    It should tell you, if you're running apache, "httpd" (this is just an example, use the port your application is using instead of 80)

    pkill -9 httpd 
    

    or

    killall -9 httpd
    
  • Michael Shimmins

    You could write a script which modified the iptables and restarts them. One script for adding a rule dropping all packets on the port, another script for removing said rule.

    The other answers have shown you how to kill the process bound to the port - this may not be what you want. If you want the server to keep running, but to prevent connections from clients then you want to block the port, not stop the process.

  • slhck

    You could probably just find out what process opened the socket that the port is associated with, and kill that process.

    But, you would have to realize that unless that process has a handler that de-initializes all the stuff that it was using (open files, sockets, forks, stuff that can linger unless it's closed properly upon termination) then you would have created that drag on system performance. Plus, the socket will remain open until the kernel realizes that that the process has been killed. That usually just takes about a minute.

    I suppose the better question would be: What port (belonging to what process) do you want to stop?

    If you are trying to put an end to a backdoor or virus that you found, then you should at least learn what data is going back and forth before you terminate it. (wireshark is good for this) (And the process' executable name so you can delete it and prevent it from coming back on reboot) or, if it's something you installed (like HTTPD or FTPD or something) then you should already have access to the process itself.

    Usually it will have a control program (HTTPD stop|start or something). Or, if it's a system thing, you probably should not mess with it. Anyway, i thought that since everyone else is giving you the "how-to" angle, i should give you the caveats.

  • Rich Homolka

    One more issue: sometime the kernel owns ports themselves. I know NAT routing holds some ports open for NAT use. You can not kill a process for this, this is a kernel, and a reconfiguration and a reboot is required.


  • Related Question

    osx - MySQL socket connections working, but not port connections
  • Neil

    I installed MySQL community 5.1.45 on my Snow Leopard 10.6, using the pkg from their site. I had previously installed a MySQL binary from entropy.ch. In the previous installation, the connections were working fine before I upgrade to Snow Leopard. In Snow Leopard, both the installations are problematic.

    Using an app called Sequel Pro, if I connect with the socket operation, it connects properly. However, a standard connection with the same credentials doesn't work. From what I've understood, socket connections happen on the machine itself between processes, whereas normal connections occur over the network/ports, in this case a loopback to my machine, since the server and client are both on the same machine.

    My new CakePHP installation isn't being able to connect to the db with the root credentials I provided. Btw, I've been starting the MySQL server using the Preference Pane.

    When I tried running mysqld from terminal, it gave me:

    100323 1:54:37 [Warning] Can't create test file /usr/local/mysql-5.1.45-osx10.6-x86_64/data/mbp.lower-test 100323 1:54:37 [Warning] Can't create test file /usr/local/mysql-5.1.45-osx10.6-x86_64/data/mbp.lower-test mysqld: Can't change dir to '/usr/local/mysql-5.1.45-osx10.6-x86_64/data/' (Errcode: 13) 100323 1:54:37 [ERROR] Aborting

    100323 1:54:37 [Note] mysqld: Shutdown complete

    mbp is the name of my machine. How do I fix this so that my webserver can connect to the mysql server?


  • Related Answers
  • Craig

    The permissions in mysql for socket connections are separate from the network connections.

    This will allow network connections:

    grant all privileges on dbname.* to USERNAME@% identified by 'password'