bindsnoop(8)

🎀 bindsnoop(8) 🎀

💅 NAME 💅

okay so bindsnoop is the tool that traces bind() system calls 🦋 It's giving "I see every single socket getting bound" energy ✨

🧚 SYNOPSIS 🧚

bindsnoop [-h] [-w] [-t] [-p PID] [-P PORT] [-E] [-U] [-u UID] [--count]
[--cgroupmap MAP] [--mntnsmap MNTNSMAP]

🌸 DESCRIPTION 🌸

bestie, listen 👂 bindsnoop reports the socket options that get set before the bind call, because those options can totally change how bind behaves. It's the tea before the tea ☕✨

📋 REQUIREMENTS 📋

You'll need CONFIG_BPF and bcc 💜 no cap, nothing works without them 🙈

✨ OPTIONS ✨

• -h, --help — shows the help message and then exits 💖
• -t, --timestamp — adds a timestamp to the output ⏰
• -w, --wide — wider columns so IPv6 addresses actually fit 🌈
• -p PID, --pid PID — only traces this PID 🎯
• -P PORT, --port PORT — a comma-separated list of ports to trace 🍓
• --cgroupmap MAP — traces the cgroups that live in this BPF map 🧁
• --mntnsmap MNTNSMAP — traces the mount namespaces that live in this BPF map 🗂️
• -E, --errors — includes errors in the output 🙈
• -U, --print-uid — includes the UID in the output 🪪
• -u UID, --uid UID — only traces this UID 👑
• --count — counts binds per source IP and port 📊

🦋 EXAMPLES 🦋

Here's how you use it, bestie 💅

• Trace all IPv4 and IPv6 bind()s: bindsnoop
• Include timestamps: bindsnoop -t
• Trace PID 181: bindsnoop -p 181
• Trace port 80: bindsnoop -P 80
• Trace port 80 and 81: bindsnoop -P 80,81
• Include UID: bindsnoop -U
• Trace UID 1000: bindsnoop -u 1000
• Report bind errors: bindsnoop -E
• Count binds per src ip: bindsnoop --count

🔮 Socket flags 🔮

So this one is literally the main event 😭 It traces IPv4 and IPv6 bind system calls and reports the socket options that would impact how bind behaves:

SOL_IP IP_FREEBIND              F....

SOL_IP IP_TRANSPARENT           .T...

SOL_IP IP_BIND_ADDRESS_NO_PORT  ..N..

SOL_SOCKET SO_REUSEADDR         ...R.

SOL_SOCKET SO_REUSEPORT         ....r

⚠️ Heads up, babe: SO_BINDTODEVICE interface is reported as an "IF" index. Don't skip this part 🥺

---

🌈 SOURCE 🌈

This one is from bcc, obviously 💖

https://github.com/iovisor/bcc

Also check the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool, and it's honestly so helpful 🫶

💻 OS 💻

Linux, only. Sorry, Mac girlies 🍎🙈

🧪 STABILITY 🧪

Unstable, it's still in development 🚧 So be a little careful 💀

👩‍💻 AUTHOR 👩‍💻

Pavel Dubovitsky is the genius behind this 👑

🔗 SEE ALSO 🔗

tcpaccept(8) 🦋

---

Okay that's the whole tea 🫖 This page is from bcc, dated 12 February 2020, and it's all about bindsnoop(8) 💜 Periodt ✨🎀