paperlined.org
apps > tcpdump
document updated 18 days ago, on Feb 24, 2025

using strace to record which PIDs go with which TCP srcaddr+srcport and dstaddr+dstport

This script is related to using strace with CGI scripts. However, this method can be used anywhere that strace can.

#!/usr/bin/bash

exec strace -e trace=socket,connect,close,accept,bind,listen,getpeername,getsockopt \
        -v -s 1000 \
        -o /tmp/strace.$$ \
        perl -x "$0" "$@"

exit

#!/usr/bin/perl

# (normal Perl script)

Then, some of these logfile lines will indicate the local and remote addresses:

...
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 6
connect(6, {sa_family=AF_INET, sin_port=htons(50000), sin_addr=inet_addr("192.168.101.60")}, 16) = 0
getsockname(6, {sa_family=AF_INET, sin_port=htons(55616), sin_addr=inet_addr("192.168.101.86")}, [16]) = 0
...
close(6)                                = 0
...

(where red indicates the local address, and blue indicates the remote address)

TODO: For listening sockets, maybe accept() would contain the information?