On Tue, Apr 14, 2020 at 09:46:00PM -0400, Joshua Abraham wrote: > Hello Stefan, > > This blog post [0] talks about the AF_VSOCK monitoring device > (vsockmon) Stefan upstreamed into Linux a few years ago. It seems to > me the same rationale for enabling packet captures for AF_VSOCK > traffic applies to UNIX domain sockets as well. What do you think? I > have a proof of concept patch for Linux for a unixmon capture device > if you think this is a good idea. > > [0] https://blog.vmsplice.net/2017/07/packet-capture-coming-to-afvsock.html
Sorry, I didn't see your email until now. Unlike AF_VSOCK, AF_UNIX has no control packets so the capture would only consist of the data which you can already see using strace(1). So while you really need this feature in order to inspect AF_VSOCK traffic you don't strictly need it for AF_UNIX. Maybe that is why this feature has never been implemented. I suggest asking the Linux AF_UNIX and networking maintainers if this feature could be merged. I've CCed them. Stefan
signature.asc
Description: PGP signature
