Knockd disabled but it still intercepts packets [on hold]











0














I set up knockd on latest Debian stable to enable pretty knocking but it didn't work reliably so I settled on doing it myself using just iptables.



However, I couldn't get that to work using the exact same ports as before and finally figured out that it was because knockd intercepted the packets so I stopped knockd, but it still intercepts the packets to those ports!



How is it doing that and how can I stop it without rebooting the server, preferably ?









share















migration rejected from security.stackexchange.com 2 days ago


This question came from our site for information security professionals. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.





put on hold as off-topic by Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl 2 days ago


This question appears to be off-topic. The users who voted to close gave this specific reason:


  • "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl














  • Did you start knockd as a daemon? [ -d option ]
    – jim mcnamara
    2 days ago










  • cross-posted: serverfault.com/questions/947802/…
    – Thomas
    2 days ago










  • Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
    – Peter Lind
    2 days ago


















0














I set up knockd on latest Debian stable to enable pretty knocking but it didn't work reliably so I settled on doing it myself using just iptables.



However, I couldn't get that to work using the exact same ports as before and finally figured out that it was because knockd intercepted the packets so I stopped knockd, but it still intercepts the packets to those ports!



How is it doing that and how can I stop it without rebooting the server, preferably ?









share















migration rejected from security.stackexchange.com 2 days ago


This question came from our site for information security professionals. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.





put on hold as off-topic by Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl 2 days ago


This question appears to be off-topic. The users who voted to close gave this specific reason:


  • "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl














  • Did you start knockd as a daemon? [ -d option ]
    – jim mcnamara
    2 days ago










  • cross-posted: serverfault.com/questions/947802/…
    – Thomas
    2 days ago










  • Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
    – Peter Lind
    2 days ago
















0












0








0







I set up knockd on latest Debian stable to enable pretty knocking but it didn't work reliably so I settled on doing it myself using just iptables.



However, I couldn't get that to work using the exact same ports as before and finally figured out that it was because knockd intercepted the packets so I stopped knockd, but it still intercepts the packets to those ports!



How is it doing that and how can I stop it without rebooting the server, preferably ?









share















I set up knockd on latest Debian stable to enable pretty knocking but it didn't work reliably so I settled on doing it myself using just iptables.



However, I couldn't get that to work using the exact same ports as before and finally figured out that it was because knockd intercepted the packets so I stopped knockd, but it still intercepts the packets to those ports!



How is it doing that and how can I stop it without rebooting the server, preferably ?







networking tcp udp packet port





share














share












share



share








edited 2 days ago









mattia.b89

761319




761319










asked 2 days ago









Peter LindPeter Lind

1




1




migration rejected from security.stackexchange.com 2 days ago


This question came from our site for information security professionals. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.





put on hold as off-topic by Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl 2 days ago


This question appears to be off-topic. The users who voted to close gave this specific reason:


  • "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl





migration rejected from security.stackexchange.com 2 days ago


This question came from our site for information security professionals. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.





put on hold as off-topic by Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl 2 days ago


This question appears to be off-topic. The users who voted to close gave this specific reason:


  • "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl













  • Did you start knockd as a daemon? [ -d option ]
    – jim mcnamara
    2 days ago










  • cross-posted: serverfault.com/questions/947802/…
    – Thomas
    2 days ago










  • Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
    – Peter Lind
    2 days ago




















  • Did you start knockd as a daemon? [ -d option ]
    – jim mcnamara
    2 days ago










  • cross-posted: serverfault.com/questions/947802/…
    – Thomas
    2 days ago










  • Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
    – Peter Lind
    2 days ago


















Did you start knockd as a daemon? [ -d option ]
– jim mcnamara
2 days ago




Did you start knockd as a daemon? [ -d option ]
– jim mcnamara
2 days ago












cross-posted: serverfault.com/questions/947802/…
– Thomas
2 days ago




cross-posted: serverfault.com/questions/947802/…
– Thomas
2 days ago












Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
– Peter Lind
2 days ago






Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
– Peter Lind
2 days ago












0






active

oldest

votes

















0






active

oldest

votes








0






active

oldest

votes









active

oldest

votes






active

oldest

votes

Popular posts from this blog

How to make a Squid Proxy server?

Is this a new Fibonacci Identity?

19世紀