undump.bt(8)

💖 undump.bt(8) — System Manager's Manual ✨

bestie, okay so undump.bt is a bpftrace tool that catches UNIX domain socket packages as they get received 🦋 It's written in bpftrace/eBPF, so it's giving low-level and it's honestly iconic.

---

🎀 NAME 🎀

undump.bt — Catch UNIX domain socket packages. Uses bpftrace/eBPF. 💅

🧚 SYNOPSIS 🧚

undump.bt

📖 DESCRIPTION 📖

okay so undump.bt tracks reception of UNIX domain sockets. main character energy 👑

it's also a basic example of bpftrace and kprobes, so if you're learning, this one is lowkey the perfect starter 🌸

⚠️ bestie, this uses BPF, so only the root user can run this tool. no cap, you need to be root 😭

🍓 REQUIREMENTS 🍓

you'll need CONFIG_BPF and bpftrace. that's it, that's the whole list 💜

✨ EXAMPLES ✨

Trace reception of UNIX domain sockets:

# undump.bt

💅 FIELDS 💅

• TIME — a timestamp on the output, in "HH:MM:SS" format 🕰️
• COMM — the process COMM 🫶
• PID — the process ID 🔥
• SIZE — the size of the received packet, in bytes 📦
• DATA — displays received packets in hex or string 🌈

🌊 OVERHEAD 🌊

the overhead mainly comes from the data packets received by the terminal output. so yeah, the printing is the expensive part 🙈

🌍 SOURCE 🌍

this is from bpftrace, so the main source is:

https://github.com/bpftrace/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file. it has example usage, output, and commentary for this tool, and it's giving very helpful 🧠

this is a bpftrace version of the bcc examples/tracing tool of the same name. the bcc tool may provide more options and customizations, so check it out if you want more 💖

https://github.com/iovisor/bcc

🐧 OS 🐧

Linux 🐧

🧪 STABILITY 🧪

🚧 Unstable — it's still in development, so bestie, expect some drama 🙈

👩‍💻 AUTHOR 👩‍💻

Rong Tao 🫶

🔗 SEE ALSO 🔗

opensnoop.bt(8) 🦋

---

bestie, that's the whole undump.bt tea ☕💜 it's from the USER COMMANDS section, dated 2022-06-03, and it's all about undump.bt(8). love you, mwah 😘🌸✨