bindsnoop(8) bindsnoop(8)

# [NAME](#NAME)

bindsnoop - Trace bind() system calls.

# [SYNOPSIS](#SYNOPSIS)

**bindsnoop \[-h] \[-w] \[-t] \[-p PID] \[-P PORT] \[-E] \[-U] \[-u UID] \[--count] \[--cgroupmap MAP] \[--mntnsmap MNTNSMAP]**

# [DESCRIPTION](#DESCRIPTION)

bindsnoop reports socket options set before the bind call that would impact this system call behavior.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bcc.

# [OPTIONS:](#OPTIONS:)

[Show help message and exit:](#Show)

[**-h, --help**](#h)

[Include timestamp on output:](#Include)

[**-t, --timestamp**](#t)

[Wider columns (fit IPv6):](#Wider)

[**-w, --wide**](#w)

[Trace this PID only:](#Trace)

[**-p PID, --pid PID**](#p)

[Comma-separated list of ports to trace:](#Comma_separated)

[**-P PORT, --port PORT**](#P)

[Trace cgroups in this BPF map:](#Trace~2)

[**--cgroupmap MAP**](#cgroupmap)

[Trace mount namespaces in this BPF map:](#Trace~3)

[**--mntnsmap MNTNSMAP**](#mntnsmap)

[Include errors in the output:](#Include~2)

[**-E, --errors**](#E)

[Include UID on output:](#Include~3)

[**-U, --print-uid**](#U)

[Trace this UID only:](#Trace~4)

[**-u UID, --uid UID**](#u)

[Count binds per src ip and port:](#Count)

[**--count**](#count)

# [EXAMPLES:](#EXAMPLES:)

[Trace all IPv4 and IPv6 **bind**()s](#Trace~5)

[**bindsnoop**](#bindsnoop)

[Include timestamps](#Include~4)

**bindsnoop -t**

[Trace PID 181](#Trace~6)

**bindsnoop -p 181**

[Trace port 80](#Trace~7)

**bindsnoop -P 80**

[Trace port 80 and 81](#Trace~8)

**bindsnoop -P 80,81**

[Include UID](#Include~5)

**bindsnoop -U**

[Trace UID 1000](#Trace~9)

**bindsnoop -u 1000**

[Report bind errors](#Report)

**bindsnoop -E**

[Count bind per src ip](#Count~2)

**bindsnoop --count**

Trace IPv4 and IPv6 bind system calls and report socket options that would impact bind call behavior:

[SOL\_IP IP\_FREEBIND F....](#SOL_IP)

[SOL\_IP IP\_TRANSPARENT .T...](#SOL_IP~2)

[SOL\_IP IP\_BIND\_ADDRESS\_NO\_PORT ..N..](#SOL_IP~3)

[SOL\_SOCKET SO\_REUSEADDR ...R.](#SOL_SOCKET)

[SOL\_SOCKET SO\_REUSEPORT ....r](#SOL_SOCKET~2)

SO\_BINDTODEVICE interface is reported as "IF" index

# [SOURCE](#SOURCE)

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Pavel Dubovitsky

# [SEE ALSO](#SEE_ALSO)

[tcpaccept(8)](/man/enterprise-packages/bcc/tcpaccept.8)

12 February 2020

---

Document: bindsnoop(8) from bcc 0.37.0-r2 (Chainguard OS)
Source: https://github.com/iovisor/bcc