Linux: How to get notified of newly created sockets? -

i'm looking way notified immediately, in userspace, when new socket has been created. our existing implementation polling read on /proc/net/tcp , /proc/net/udp, not work short-lived sockets (e.g. send datagram , close).

you try:

• auditing socket or socketcall syscalls. if not using audit daemon, requires writing netlink code. if want coexist other userspace trying access audit system, you'll need 3.15 kernel multicast netlink sockets.
• writing custom linux security module uses favourite event mechanism notify userspace of new socket.
• doing system call or library call tracing, recursively, using strace or ltrace, if don't mind hackiness, raciness, , overhead.
• replacing socket system calls shim layer. requires writing own kernel module.
• ftracing function tracer, , limiting functions trace either socket syscall, or type-specific initialization functions delegates to.
• kprobing mentioned kernel functions of interest, , using favourite mechanism of notifying userspace.