Snooping on sockets/file descriptors

[Florin Malita]

On 03/31/11 15:29, Vimal wrote:
> Is it possible for an application (say "snoop", with sufficient
> privileges) to monitor data on any socket/file descriptor in the
> system?
"snoop" it is :)

http://sourceforge.net/projects/snoop/


> Here's an example:  suppose we have a browser and it creates a tcp
> socket to connect to a URL.  Whenever the browser issues a read() and
> data is pushed to user space, I want "snoop" to get notified and made
> available a copy of the same data that the browser read.

For this particular scenario snoop may not be the best choice: while it 
can attach on-the-fly when opening local files (inotify trigger), socket 
FDs must be picked manually after they've been opened 
(/proc/<pid>/fd/...) - so unless your connection is long-lived, this is 
going to be tricky.

--
Florin