Linux: How to get notified of newly created sockets? -


i'm looking way notified immediately, in userspace, when new socket has been created. our existing implementation polling read on /proc/net/tcp , /proc/net/udp, not work short-lived sockets (e.g. send datagram , close).

you try:

  • auditing socket or socketcall syscalls. if not using audit daemon, requires writing netlink code. if want coexist other userspace trying access audit system, you'll need 3.15 kernel multicast netlink sockets.
  • writing custom linux security module uses favourite event mechanism notify userspace of new socket.
  • doing system call or library call tracing, recursively, using strace or ltrace, if don't mind hackiness, raciness, , overhead.
  • replacing socket system calls shim layer. requires writing own kernel module.
  • ftracing function tracer, , limiting functions trace either socket syscall, or type-specific initialization functions delegates to.
  • kprobing mentioned kernel functions of interest, , using favourite mechanism of notifying userspace.

Comments

Popular posts from this blog

android - Get AccessToken using signpost OAuth without opening a browser (Two legged Oauth) -

org.mockito.exceptions.misusing.InvalidUseOfMatchersException: mockito -

google shop client API returns 400 bad request error while adding an item -