Snooping on sockets/file descriptors

[Mulyadi Santosa]

On Fri, Apr 1, 2011 at 03:04, Vimal <j.vimal at gmail.com> wrote:
> Hi Daniel,
>
>>
>> How about tcpdump?
>>
>
> Thanks for the suggestion.
>
> tcpdump is good, but it doesn't solve all problems.  There are a few reasons:
>
> * TCP packets could arrive out of order
> * The data needn't belong to a valid TCP connection
> * The app could just discard data (close/flush/etc)
>
> In short, there is a lot of state and complex logic which act on the
> packets before it is seen by the application.

then, something like dtrace or systemtap? IMO you're looking for kinda
combo of kernel mode + user land "sniffer"... the user land sniffer,
in it's very simple form, is by using LD_PRELOAD ...

-- 
regards,

Mulyadi Santosa
Freelance Linux trainer and consultant

blog: the-hydra.blogspot.com
training: mulyaditraining.blogspot.com