undump.bt(8)

📦 version 0.17.0, in debian bookworm

✨ undump.bt(8) ✨

okay bestie, welcome to the undump.bt page, straight out of the System Manager's Manual 💖 she's a little script, she's a whole vibe, and she's about to catch some UNIX domain socket packages for you.

🎀 NAME 🎀

undump.bt — catch UNIX domain socket packages. Uses bpftrace/eBPF. no cap 💅

🦋 SYNOPSIS 🦋

undump.bt

🌸 DESCRIPTION 🌸

So undump.bt tracks reception of UNIX domain sockets. like, it watches them arrive. it's giving surveillance but make it cute 🫶

This program is also a basic example of bpftrace and kprobes. so if you're trying to figure out how kprobes work, she's literally right there, serving as a tutorial. iconic.

⚠️ Since this uses BPF, only the root user can use this tool. not me casually trying to run it as a normal user 😭 nope, root only, periodt.

💜 REQUIREMENTS 💜

  • CONFIG_BPF
  • bpftrace

that's it bestie. that's the whole list. two things. slay.

🍓 EXAMPLES 🍓

Trace reception of UNIX domain sockets:

# undump.bt

that's the whole command. no flags, no drama, just vibes 🌈

🧚 FIELDS 🧚

here's the tea on what each column means, ok so:

  • TIME — a timestamp on the output, in "HH:MM:SS" format. ⭐
  • COMM — the process COMM. 👑
  • PID — the process ID. the whole "who is this" moment.
  • SIZE — the size of the received packet, in bytes. yes, actual bytes, we measure here 💅
  • DATA — display received packets in hex or string. so you get to see the goods 🎀

🔥 OVERHEAD 🔥

The overhead of this program mainly comes from the data packets received by the terminal output. so like... the terminal is the one doing the heavy lifting here. if you dump a lot of packets, the printing is what's gonna get you, not the tracing. fr fr. 👀

💖 SOURCE 💖

This is from bpftrace.

https://github.com/iovisor/bpftrace

Also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. yes bestie, there's bonus content, go read it 📖✨

This is a bpftrace version of the bcc examples/tracing of the same name. The bcc tool may provide more options and customizations.

https://github.com/iovisor/bcc

so if you want more knobs to turn, bcc is your girl 💜

🌈 OS 🌈

Linux 🐧 (as if there was any doubt)

💀 STABILITY 💀

Unstable - in development.

so like, she's growing, she's evolving, she's in her development era 🦋 don't be surprised if she changes on you.

👑 AUTHOR 👑

Rong Tao — give them their flowers 💐

🙈 SEE ALSO 🙈

and that's the page!! undump.bt(8) from the USER COMMANDS section, dated 2022-06-03. mwah, ily, go trace some sockets responsibly 💖💅✨

📦 where this page comes from