Snooping on sockets/file descriptors

Javier Martinez Canillas martinez.javier at
Fri Apr 1 09:34:33 EDT 2011

On Fri, Apr 1, 2011 at 9:23 AM, Vimal <j.vimal at> wrote:
>> then, something like dtrace or systemtap? IMO you're looking for kinda
>> combo of kernel mode + user land "sniffer"... the user land sniffer,
>> in it's very simple form, is by using LD_PRELOAD ...
> dtrace seems fine and is similar to ptrace.  But then, one would have
> to enumerate all possible syscalls that the application can issue to
> read data.  For e.g., it could use read(), recvfrom(), recvmsg(), or
> even syscall(syscall#, args...)
> I wonder if LD_PRELOAD can be done on a program without shutting it
> down.  ptrace fits the bill here, except for the above problem.

If you want to do it in the kernel, you can write a loadable kernel
module to register netfilter hooks and obtain the socket buffers

Look at this blog entry:

Hope it helps.


Javier Martínez Canillas
(+34) 682 39 81 69
PhD Student in High Performance Computing
Computer Architecture and Operating System Department (CAOS)
Universitat Autònoma de Barcelona
Barcelona, Spain

More information about the Kernelnewbies mailing list