Package: unixdump
unixdump"tcpdump for unix domain sockets"unixdumpis a powerful command-line Unix domain socket "packet" capturer. It
is an eBPF-based kernel tracing tool that extracts, processes, and dumps all
data sent over unix domain sockets across an entire Linux host with support
for performant in-kernel filters for a wide range of filtering granularity. It
enables manual traffic inspection of Unix socket traffic between processes,
including ancillary data, such as file descriptors and Unix credentials.InstallationBCCunixdumpdepends on the BCC eBPF tracing tool framework. See theBCC install instructionsfor your distribution. We recommend building and installing BCC fromsource.Note:While BCC updates may result in breakages, the current version ofunixdumpis known to work with version0.24.0on Ubuntu 20.04 when using clang/llvm 10 fromhttps://apt.llvm.org/(bcc's
build hardcodes llvm 10 paths). If you are having issues withunixdump,
please make sure you are not running an out-of-date version of BCC (such as if
you installed theUbuntu packages).unixdumpVia pipsudo -H pip3 install unixdumpFrom sourcesudo python3 setup.py installorpython3 setup.py bdist_wheel
sudo -H pip3 install ./dist/unixdump-*.whlUsageunixdumpis best used with filters. Several of the important ones are definedbelow, and the rest can be listed with--help. To dump all Unix
domain socket traffic of a system (sans the terminal process rendering the
output), rununixdumpwithout any arguments:Note:unixdumprequiresCAP_SYS_ADMINprivileges and full access tosysfs/debugfs.sudo unixdumpFor an example use case, let's say we know the program creates a Unix domain
socket with random characters that begins with/tmp/domain-socket-. We can
limit our output to only sockets beginning with that string:sudo unixdump -b -s '/tmp/domain-socket'The output can be further restricted using combinations ofunixdumpfilter
options.Optionsunixdumpprovides many different arguments to filter output and fine tune
performance. Below are some of the more notable options:-s, --socket: When the user knows the exact name of the socket path, this is
the option to use. By specifying an empty string like so-s '',unixdumpwill filter on unnamed sockets.-@, --base64: To filter on binary abstract namespace keys, this option
instructsunixdumpto parse the-b/-soptions as base64.-b, --beginswith: One ofunixdump's most useful filters is to match starting
sequences of socket paths. This proves extremely helpful when the program creates
socket paths ending with random characters yet the beginning is unique and constant.
This makes filtering possible without knowing the entire socket name ahead of time.-p, --pid: To home in on a specific process (and anything communicating
with it), use this option.-x, --exclude: For when the user is listening for general traffic and wants to
hide noisy processes such asXorg. This argument takes a space separated list
ofpidsto exclude.-t, --excludeownterminal: (requireswmctrl) Attempts to exclude the current terminal process
from capture. Currently supports Wayland and X11, and thetmuxandscreenterminal multiplexers.Note:screen is not currently supported on Wayland-l, --ancillarydata: For those who want to only watch for traffic containing
ancillary data. This will provide the file descriptors or Unix credentials that
were sent.-o, --dir: To save output into separate files based onpidpairs. The
option-c, --colorcan also be set to add color like in wireshark.-B, --extract: Extract the buffer contents from a file saved by--dirand output it to binary in separate client and server files.