Auto-killing connections when changing IP?

I almost always have SSH sessions open when I'm using my laptop, and they
tend to suffer from the following problem: if I suspend the laptop and wake
it up elsewhere, those sessions are still up but unusable: they freeze
because the TCP connection can't be used anymore since the machine has
a different IP number.

The fact that the TCP connections are preserved is good occasionally
(typically when I don't move the laptop so I reconnect to the same DHCP
server which gives me the same IP so the TCP connections can keep on working
(tho if the router does NAT it may have forgotten about that TCP
connection and it still freezes)).
But usually, it's annoying more than anything else, because I have to go and
kill the processes explicitly/manually.

Is there some way to kill all TCP connections that go over the network
interface `foo' whenever this interface is brought up with an IP address
different from the one it had before?


Stefan

Stefan Monnier <(E-Mail Removed)> wrote:
> Is there some way to kill all TCP connections that go over the network
> interface `foo' whenever this interface is brought up with an IP address
> different from the one it had before?

Try an iptables -t nat ... -j MASQUERADE rule
Chris

Hello,

Chris Davies a écrit :
> Stefan Monnier <(E-Mail Removed)> wrote:
>
>>Is there some way to kill all TCP connections that go over the network
>>interface `foo' whenever this interface is brought up with an IP address
>>different from the one it had before?
>
> Try an iptables -t nat ... -j MASQUERADE rule

Note that this won't affect existing connections in the TCP/IP stack and
sockets ; it will only erase them in the Netfilter connection tracking
table. Also note that it won't make a difference whether the interface
is brought up again with a different address.

>> Is there some way to kill all TCP connections that go over the network
>> interface `foo' whenever this interface is brought up with an IP address
>> different from the one it had before?
> Try an iptables -t nat ... -j MASQUERADE rule

Where... on the router? I have no control on the router(s).

.... on my laptop? I have no `nat' table on my laptop (my iptables are 100%
empty).


Stefan

Stefan Monnier <(E-Mail Removed)> writes:

>>> Is there some way to kill all TCP connections that go over the network
>>> interface `foo' whenever this interface is brought up with an IP address
>>> different from the one it had before?

When it is brought down all tcp connections die. HOwever, the programs on
the two ends may well try again.
Ie, just because the network is brought down does not mean that say ssh
dies or something-- why should it? It will simply send out more packets.

The machine at the other end may or may not get upset when it suddenly sees
packets arive from a different IP.
But that is clearly not under your control.


>> Try an iptables -t nat ... -j MASQUERADE rule

>Where... on the router? I have no control on the router(s).

>... on my laptop? I have no `nat' table on my laptop (my iptables are 100%
>empty).


> Stefan

>>>> Is there some way to kill all TCP connections that go over the network
>>>> interface `foo' whenever this interface is brought up with an IP address
>>>> different from the one it had before?
> When it is brought down all tcp connections die.

No, they do not.

> However, the programs on the two ends may well try again. I.e., just
> because the network is brought down does not mean that say ssh dies or
> something-- why should it? It will simply send out more packets.

I can assure you that if the TCP connection were to die, ssh would die
as well.

> The machine at the other end may or may not get upset when it suddenly
> sees packets arive from a different IP. But that is clearly not under
> your control.

I know. And I don't care about the machine at the other end.
But I want to take down locally the outgoing connections.


Stefan

Stefan Monnier <(E-Mail Removed)> wrote:
>Is there some way to kill all TCP connections that go over the network
>interface `foo' whenever this interface is brought up with an IP address
>different from the one it had before?

Chris Davies a écrit :
> Try an iptables -t nat ... -j MASQUERADE rule

Pascal Hambourg <boite-a-(E-Mail Removed)> wrote:
> Note that this won't affect existing connections in the TCP/IP stack and
> sockets ; it will only erase them in the Netfilter connection tracking
> table.

Yes. Re-reading the man page (yet again - I learn something fresh each
time) I've now realised that, thanks. Perhaps the OP might like to play
around with "cutter". Something like this, triggered when the interface
is dropped, seems reasonable to me:

netstat -na |
awk '$1 ~ /^tcp/ && /ESTABLISHED/ {
split($4,s,":"); split($5,d,":"); print s[1],s[2],d[1],d[2] }
' |
xargs -n4 cutter

Chris

>> Is there some way to kill all TCP connections that go over the network
>> interface `foo' whenever this interface is brought up with an IP address
>> different from the one it had before?

> Chris Davies a écrit :
>> Try an iptables -t nat ... -j MASQUERADE rule

> Pascal Hambourg <boite-a-(E-Mail Removed)> wrote:
>> Note that this won't affect existing connections in the TCP/IP stack and
>> sockets ; it will only erase them in the Netfilter connection tracking
>> table.

> Yes. Re-reading the man page (yet again - I learn something fresh each
> time) I've now realised that, thanks. Perhaps the OP might like to play
> around with "cutter". Something like this, triggered when the interface
> is dropped, seems reasonable to me:

> netstat -na |
> awk '$1 ~ /^tcp/ && /ESTABLISHED/ {
> split($4,s,":"); split($5,d,":"); print s[1],s[2],d[1],d[2] }
> ' |
> xargs -n4 cutter

Thanks, this is close to what I want indeed.
But it turns out that `cutter' is really meant to be run on the
router(firewall) machine, rather than on my laptop. I.e. it can kill
connection that go *through* a machine, but not the connections that
start/end at the current machine. It doesn't look an inherent limitation in
the technique it uses, so maybe I'll try and find the time to play with the
source code.

Still it seems like for my specific problem, `cutter' is a bit heavy handed
and a simpler solution should be possible. Still, following your suggestion
I googled for tcp cutting and tcp killing, and I found `tcpkill' which is
also a close match, except it only kills the connections on which there is
activity and it doesn't know when to stop (basically it monitors tcp
activity of a specified kind and kills it whenever it sees it, without being
able to tell if there are such connections left or not).


Stefan