How to close TCP and UDP ports via windows command

Question

Does somebody knows how to close a TCP or UDP socket for a single connection via windows command line?

Googling about this, I saw some people asking the same thing. But the answers looked like a manual page of netstat or netsh commands focusing on how to monitor the ports. I don't want answers on how to monitor them (I already do this). I want to close/kill them.

EDIT, for clarification: Let's say that my server listens TCP port 80. A client makes a connection and port 56789 is allocated for it. Then, I discover that this connection is undesired (e.g. this user is doing bad things, we asked them to stop but the connection didn't get dropped somewhere along the way). Normally, I would add a firewall to do the job, but this would take some time, and I was in an emergency situation. Killing the process that owns the connection is really a bad idea here because this would take down the server (all users would lose functionality when we just want to selectively and temporally drop this one connection).

Answer 1

1. open cmd

   • type in netstat -a -n -o

   • find TCP [the IP address]:[port number] .... #[target_PID]# (ditto for UDP)

   • (Btw, kill [target_PID] didn't work for me)

2. CTRL+ALT+DELETE and choose "start task manager"

   • Click on "Processes" tab

   • Enable "PID" column by going to: View > Select Columns > Check the box for PID

   • Find the PID of interest and "END PROCESS"

3. Now you can rerun the server on [the IP address]:[port number] without a problem

Answer 2

You can't close sockets on your server without owning those sockets hence you can't actually close the socket down without having code running in the process that owns the server socket.

However, there is another option which is telling the client to close its socket. Sending a RST TCP packet to the port the client is connecting on will cause the client to drop their connection. You can do that with RST scanning using nmap.

http://nmap.org/

Answer 3

In order to close the port you could identify the process that is listening on this port and kill this process.

Answer 4

I found the right answer to this one. Try TCPView from Sysinternals, now owned by Microsoft. You can find it at http://technet.microsoft.com/en-us/sysinternals/bb897437

Answer 5

you can use program like tcpview from sysinternal. I guess it can help you a lot on both monitoring and killing unwanted connection.

Answer 6

You can't close sockets without shutting down the process that owns those sockets. Sockets are owned by the process that opened them. So to find out the process ID (PID) for Unix/Linux. Use netstat like so:

netstat -a -n -p -l

That will print something like:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State     PID/Program name   
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN     1879/sendmail: acce 
tcp        0      0 0.0.0.0:21                  0.0.0.0:*                   LISTEN     1860/xinetd         

Where -a prints all sockets, -n shows the port number, -p shows the PID, -l shows only what's listening (this is optional depending on what you're after).

The real info you want is PID. Now we can shutdown that process by doing:

kill 1879

If you are shutting down a service it's better to use:

service sendmail stop

Kill literally kills just that process and any children it owns. Using the service command runs the shutdown script registered in the init.d directory. If you use kill on a service it might not properly start back up because you didn't shut it down properly. It just depends on the service.

Unfortunately, Mac is different from Linux/Unix in this respect. You can't use netstat. Read this tutorial if you're interested in Mac:

http://www.tech-recipes.com/rx/227/find-out-which-process-is-holding-which-socket-open/

And if you're on Windows use TaskManager to kill processes, and services UI to shutdown services. You can use netstat on Windows just like Linux/Unix to identify the PID.

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/netstat.mspx?mfr=true