sofdsnoop(8) System Manager's Manual sofdsnoop(8)

# [NAME](#NAME)

sofdsnoop - Trace FDs passed through unix sockets. Uses Linux eBPF/bcc.

# [SYNOPSIS](#SYNOPSIS)

**sofdsnoop \[-h] \[-T] \[-p PID] \[-t TID] \[-n NAME] \[-d DURATION]**

# [DESCRIPTION](#DESCRIPTION)

sofdsnoop traces FDs passed through unix sockets

Every file descriptor that is passed via unix sockets os displayed on separate line together with process info (TID/COMM columns), ACTION details (SEND/RECV), file descriptor number (FD) and its translation to file if [available (NAME)](/man/enterprise-packages/bcc/available.NAME).

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bcc.

# [OPTIONS](#OPTIONS)

[-h](#h)

Print usage message.

[-T](#T)

Include a timestamp column.

[-p PID](#p)

Trace this process ID only (filtered in-kernel).

[-t TID](#t)

Trace this thread ID only (filtered in-kernel).

[-d DURATION](#d)

Total duration of trace in seconds.

[-n NAME](#n)

Only print command lines matching this command name (regex)

# [EXAMPLES](#EXAMPLES)

[Trace all sockets:](#Trace)

\# **sofdsnoop**

[Trace all sockets, and include timestamps:](#Trace~2)

\# **sofdsnoop -T**

[Only trace sockets where the process contains "server":](#Only)

\# **sofdsnoop -n server**

# [FIELDS](#FIELDS)

[TIME(s)](#TIME%28s%29)

Time of SEDN/RECV actions, in seconds.

[ACTION](#ACTION)

Operation on the fd SEND/RECV.

[TID](#TID)

Process TID

[COMM](#COMM)

Parent process/command name.

[SOCKET](#SOCKET)

The socket carrier.

[FD](#FD)

file descriptor number

[NAME](#NAME~2)

file name for SEND lines

# [SOURCE](#SOURCE)

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Jiri Olsa

# [SEE ALSO](#SEE_ALSO)

[opensnoop(1)](/man/enterprise-packages/bcc/opensnoop.1)

2018-11-08 USER COMMANDS

---

Document: spfdsnoop(8) from bcc 0.37.0-r2 (Chainguard OS)
Source: https://github.com/iovisor/bcc