Snooping on sockets/file descriptors
Javier Martinez Canillas
martinez.javier at gmail.com
Fri Apr 1 09:34:33 EDT 2011
On Fri, Apr 1, 2011 at 9:23 AM, Vimal <j.vimal at gmail.com> wrote:
>> then, something like dtrace or systemtap? IMO you're looking for kinda
>> combo of kernel mode + user land "sniffer"... the user land sniffer,
>> in it's very simple form, is by using LD_PRELOAD ...
> dtrace seems fine and is similar to ptrace. But then, one would have
> to enumerate all possible syscalls that the application can issue to
> read data. For e.g., it could use read(), recvfrom(), recvmsg(), or
> even syscall(syscall#, args...)
> I wonder if LD_PRELOAD can be done on a program without shutting it
> down. ptrace fits the bill here, except for the above problem.
If you want to do it in the kernel, you can write a loadable kernel
module to register netfilter hooks and obtain the socket buffers
Look at this blog entry:
Hope it helps.
Javier Martínez Canillas
(+34) 682 39 81 69
PhD Student in High Performance Computing
Computer Architecture and Operating System Department (CAOS)
Universitat Autònoma de Barcelona
More information about the Kernelnewbies