Knockd disabled but it still intercepts packets [on hold]
I set up knockd on latest Debian stable to enable pretty knocking but it didn't work reliably so I settled on doing it myself using just iptables.
However, I couldn't get that to work using the exact same ports as before and finally figured out that it was because knockd intercepted the packets so I stopped knockd, but it still intercepts the packets to those ports!
How is it doing that and how can I stop it without rebooting the server, preferably ?
networking tcp udp packet port
migration rejected from security.stackexchange.com 2 days ago
This question came from our site for information security professionals. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.
put on hold as off-topic by Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl 2 days ago
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl
comments disabled on deleted / locked posts / reviews |
I set up knockd on latest Debian stable to enable pretty knocking but it didn't work reliably so I settled on doing it myself using just iptables.
However, I couldn't get that to work using the exact same ports as before and finally figured out that it was because knockd intercepted the packets so I stopped knockd, but it still intercepts the packets to those ports!
How is it doing that and how can I stop it without rebooting the server, preferably ?
networking tcp udp packet port
migration rejected from security.stackexchange.com 2 days ago
This question came from our site for information security professionals. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.
put on hold as off-topic by Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl 2 days ago
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl
Did you start knockd as a daemon? [ -d option ]
– jim mcnamara
2 days ago
cross-posted: serverfault.com/questions/947802/…
– Thomas
2 days ago
Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
– Peter Lind
2 days ago
comments disabled on deleted / locked posts / reviews |
I set up knockd on latest Debian stable to enable pretty knocking but it didn't work reliably so I settled on doing it myself using just iptables.
However, I couldn't get that to work using the exact same ports as before and finally figured out that it was because knockd intercepted the packets so I stopped knockd, but it still intercepts the packets to those ports!
How is it doing that and how can I stop it without rebooting the server, preferably ?
networking tcp udp packet port
I set up knockd on latest Debian stable to enable pretty knocking but it didn't work reliably so I settled on doing it myself using just iptables.
However, I couldn't get that to work using the exact same ports as before and finally figured out that it was because knockd intercepted the packets so I stopped knockd, but it still intercepts the packets to those ports!
How is it doing that and how can I stop it without rebooting the server, preferably ?
networking tcp udp packet port
networking tcp udp packet port
edited 2 days ago
mattia.b89
761319
761319
asked 2 days ago
Peter LindPeter Lind
1
1
migration rejected from security.stackexchange.com 2 days ago
This question came from our site for information security professionals. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.
put on hold as off-topic by Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl 2 days ago
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl
migration rejected from security.stackexchange.com 2 days ago
This question came from our site for information security professionals. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.
put on hold as off-topic by Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl 2 days ago
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Thomas, sebasth, Rui F Ribeiro, Stephen Harris, RalfFriedl
Did you start knockd as a daemon? [ -d option ]
– jim mcnamara
2 days ago
cross-posted: serverfault.com/questions/947802/…
– Thomas
2 days ago
Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
– Peter Lind
2 days ago
comments disabled on deleted / locked posts / reviews |
Did you start knockd as a daemon? [ -d option ]
– jim mcnamara
2 days ago
cross-posted: serverfault.com/questions/947802/…
– Thomas
2 days ago
Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
– Peter Lind
2 days ago
Did you start knockd as a daemon? [ -d option ]
– jim mcnamara
2 days ago
Did you start knockd as a daemon? [ -d option ]
– jim mcnamara
2 days ago
cross-posted: serverfault.com/questions/947802/…
– Thomas
2 days ago
cross-posted: serverfault.com/questions/947802/…
– Thomas
2 days ago
Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
– Peter Lind
2 days ago
Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
– Peter Lind
2 days ago
comments disabled on deleted / locked posts / reviews |
0
active
oldest
votes
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Did you start knockd as a daemon? [ -d option ]
– jim mcnamara
2 days ago
cross-posted: serverfault.com/questions/947802/…
– Thomas
2 days ago
Yes, it was crossposted as I wasn't sure what the best SE site was. And yes, it was started as a daemon.
– Peter Lind
2 days ago