Snooping on sockets/file descriptors

Florin Malita fmalita at
Mon Apr 4 11:43:37 EDT 2011

On 03/31/11 15:29, Vimal wrote:
> Is it possible for an application (say "snoop", with sufficient
> privileges) to monitor data on any socket/file descriptor in the
> system?
"snoop" it is :)

> Here's an example:  suppose we have a browser and it creates a tcp
> socket to connect to a URL.  Whenever the browser issues a read() and
> data is pushed to user space, I want "snoop" to get notified and made
> available a copy of the same data that the browser read.

For this particular scenario snoop may not be the best choice: while it 
can attach on-the-fly when opening local files (inotify trigger), socket 
FDs must be picked manually after they've been opened 
(/proc/<pid>/fd/...) - so unless your connection is long-lived, this is 
going to be tricky.


More information about the Kernelnewbies mailing list