sofdsnoop(8)

📦 version 0.36.1, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

✨ NAME ✨

okay so this is sofdsnoop(8) 💅 and it's basically a tool that traces FDs passed through unix sockets 🦋 it's built on Linux eBPF/bcc, so it's giving low-level and I'm obsessed.

sofdsnoop - Trace FDs passed through unix sockets. Uses Linux eBPF/bcc.

🎀 SYNOPSIS 🎀

sofdsnoop [-h] [-T] [-p PID] [-t TID] [-n NAME] [-d DURATION]

💖 DESCRIPTION 💖

okay so sofdsnoop traces FDs passed through unix sockets ✨

every single file descriptor that gets passed over a unix socket shows up on its own line, together with process info (the TID and COMM columns) 🫶 you also get the ACTION details (SEND/RECV), the file descriptor number (FD), and its translation to a file if one is available (NAME). main character energy, no cap 👑

⚠️ bestie, since this uses BPF, only the root user can use this tool. sorry not sorry 😭

🧚 REQUIREMENTS 🧚

CONFIG_BPF and bcc. that's the whole list, lowkey simple 🌸

🔥 OPTIONS 🔥

  • -h — prints the usage message. the vibe check tool 💅
  • -T — adds a timestamp column ⏰
  • -p PID — only traces this process ID (filtered in-kernel) 🎯
  • -t TID — only traces this thread ID (filtered in-kernel) 🧵
  • -d DURATION — the total duration of the trace, in seconds ⏳
  • -n NAME — only prints command lines matching this command name (regex) 🔍

🌈 EXAMPLES 🌈

Trace all sockets:

# sofdsnoop

Trace all sockets, and include timestamps:

# sofdsnoop -T

Only trace sockets where the process contains "server":

# sofdsnoop -n server

🦋 FIELDS 🦋

  • TIME(s) — the time of SEND/RECV actions, in seconds ⏱️
  • ACTION — the operation on the fd, SEND or RECV 📤📥
  • TID — the process TID 🪪
  • COMM — the parent process/command name 👯
  • SOCKET — the socket carrier 🚚
  • FD — the file descriptor number 🔢
  • NAME — the file name for SEND lines 📁

💜 SOURCE 💜

this is from bcc, so go check it out 🍓

https://github.com/iovisor/bcc

also look in the bcc distribution for a companion _examples.txt file. it has example usage, output, and commentary for this tool, so it's giving tutorial, iykyk 🙈

🫧 OS 🫧

Linux 🐧

🌸 STABILITY 🌸

🚧 Unstable - still in development. ngl, expect some drama 💀

👑 AUTHOR 👑

Jiri Olsa 🫶

⭐ SEE ALSO ⭐

opensnoop(1) is the one to check out next 💖

okay bestie that's the whole tea 🎀 this page is from the USER COMMANDS section, dated 2018-11-08, and it's sofdsnoop(8) forever ✨💅

📦 where this page comes from