I'm working on a pentesting project, and I have the following setup: I have  an SSH daemon that is trying to log all of the activity happening on SSH connections out to another server. I'm trying to disable this logging, and in particular, do so in a way that avoids being detected. Thus, I have the following requirements:I need to be able to kill an existing TCP connection, and ideally with as little buffered data sent as possible. That is, if there's outbound data buffered in the kernel, it would be ideal if this data were dropped without being sent.In order to achieve this, it's best if the command that I need to type in is as short as possible so that the entire command can be buffered either in the logging application or in the kernel TCP buffer. This way, if the first bullet point is achieved, the logging server will never receive information about the fact that logging was disabled; it will just appear as a network outage.I've tried iptables -A OUTPUT -d <ip of logging server> -j DROP, but that doesn't do the trick - the text of the command itself manages to get sent before the rule is enforced. I've also tried tcpkill, similarly to no avail.
Kill an existing TCP connection quickly
ssh;kernel;logs;tcp;socket