undump.bt - Catch UNIX domain socket packages. Uses bpftrace/eBPF.

       Rong Tao

       undump.bt tracked reception of UNIX domain sockets.

       This program is also a basic example of bpftrace and kprobes.

       Since this uses BPF, only the root user can use this tool.

       Trace reception of UNIX domain sockets:
              # undump.bt

       TIME   A timestamp on the output, in "HH:MM:SS" format.

       COMM   The process COMM.

       PID    The process ID.

       SIZE   The size of the received packet, in bytes.

       DATA   Display received packets in hex or string.

       undump.bt - Catch UNIX domain socket packages. Uses bpftrace/eBPF.

       Linux

       The overhead of this program mainly comes from the data packets received by the terminal output.

       CONFIG_BPF and bpftrace.

opensnoop.bt(8)

USER COMMANDS                                      2022-06-03                                       undump.bt(8)

       This is from bpftrace.

              https://github.com/bpftrace/bpftrace

       Also  look  in  the  bpftrace  distribution  for a companion _examples.txt file containing example usage,
       output, and commentary for this tool.

       This is a bpftrace version of the bcc examples/tracing of the same name.  The bcc tool may  provide  more
       options and customizations.

              https://github.com/iovisor/bcc

       Unstable - in development.

undump.bt