ss -K: close a TCP connection without killing the process
- tool
- ss / netstat
- command
- ss
- flag
- -K, --kill
- default
- off (ss only displays sockets)
sudo ss -K dst 192.0.2.10 dport = :5432 forcibly closes every socket that matches the filter and prints the sockets it closed. The owning process keeps running; only that connection is torn down, so the program sees an aborted connection and usually reconnects. Use it to drop a stuck client, move connections off a database replica, or test how an application handles connection loss, without restarting the service. Without -K, ss only lists sockets.
Usage
Always run the same filter without -K first, to see exactly what would be closed:
sudo ss -tn state established '( dst 192.0.2.10 and dport = :5432 )' # preview
sudo ss -K -tn state established '( dst 192.0.2.10 and dport = :5432 )' # close them
sudo ss -K dst 198.51.100.7 # every socket to one peerThe filter syntax is the normal ss filter language: src, dst, sport, dport, state, combined with and, or and parentheses; see filter by port or address. A typo in it produces the parser error described on bison bellows while parsing filter.
Requirements
| Requirement | Why |
|---|---|
| root (CAP_NET_ADMIN) | Destroying sockets of other processes is a privileged operation |
| Linux 4.5 or later with CONFIG_INET_DIAG_DESTROY | The kernel feature that closes sockets through sock_diag |
| IPv4 or IPv6 socket | The manual limits -K to these families |
When a requirement is missing, ss skips the socket silently: the command succeeds but prints nothing. Check that the connection is gone by repeating the preview command.
What happens to the connection
The kernel aborts the socket like a reset: the remote side receives a TCP RST, and the local application's next read or write fails with an error such as connection reset or aborted. Well-written clients reconnect; connection pools discard the broken connection. Listening sockets can also match a filter, so restrict it with state established to avoid closing a server's listener.
Alternatives
| Goal | Tool |
|---|---|
| Close one connection, keep the process | ss -K with a precise filter |
| Stop all traffic to a peer | A firewall rule, which also blocks reconnects |
| Find the owner first | ss -tnp (see ss -p) |
| Restart a stuck service | The service manager, when the process itself is broken |
Connection states usable in state filters are listed in TCP socket states; to find which program owns a connection, use ss -p.
FAQ
Why does ss -K print nothing and the connection stays open?
Either the filter matched nothing, you are not root, or the kernel lacks socket-destroy support (CONFIG_INET_DIAG_DESTROY). The manual says ss silently skips sockets the kernel cannot close, so there is no error message.
What does the application see when its socket is closed with -K?
The kernel aborts the connection as if it had been reset: the peer receives a RST, and pending or later reads and writes in the local program fail, typically with a connection reset or connection aborted error.
Can I use ss -K on UDP or Unix sockets?
The manual states that -K supports IPv4 and IPv6 sockets only. Unix domain sockets cannot be closed this way.