良好的Linux TCP/IP监控工具,不需要root访问权限？

Question

我想为我正在增强的程序调试TCP/IP交互.我没有root访问权限(所以没有tcpdump等),但应用程序在我自己的id下运行.我可以使用例如strace拦截系统调用,但有没有值得推荐的替代方案？如果是这样,为什么 - 他们提供什么？命令行首选(我的电脑上没有安装X服务器:-()),但对GUI也很好奇.

理想情况下,它会说:

    app listening on port <portA>
    app listening on port <portB>
    client connection #1 accepted on listening port <portA> to local port <portC>
        from remote <hostX:portXA>
    app sent #1 <number> bytes "<data dump...>"
    app received from client #1 <number> bytes "<data dump...>"
    client #1 closed connection

会自己划伤一个,但是太多的车轮要重新发明......

提前致谢.

更新:paulrubel和ypnos都提出了非常有用的建议......(希望我能接受这两个答案,因为它们是独特的,同样好的).执行Paul建议的LD_PRELOAD拦截的代码如下:

// TCP comms trace library
//   as per http://www.jayconrod.com/cgi/view_post.py?23

#define _GNU_SOURCE

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <dlfcn.h>


typedef ssize_t (*Recv)(int s, void* buf, size_t len, int flags);

ssize_t recv(int s, void* buf, size_t len, int flags)
{
    static Recv real = NULL;

    if (!real)
        real = (Recv)dlsym(RTLD_NEXT, "recv");

    fprintf(stderr, "> recv(s '%d', buf %p, len %lld, flags %d)...\n",
            s, buf, len, flags);
    ssize_t result = real(s, buf, len, flags);
    fprintf(stderr, "< recv(s '%d', buf %p, len %lld, flags %d) return %lld\n",
            s, buf, len, flags, result);

    return result;
}

typedef ssize_t (*Send)(int s, const void* buf, size_t len, int flags);

ssize_t send(int s, const void* buf, size_t len, int flags)
{
    static Send real = NULL;

    if (!real)
        real = (Send)dlsym(RTLD_NEXT, "send");

    fprintf(stderr, "> send(s '%d', buf %p, len %lld, flags %d)...\n",
            s, buf, len, flags);
    ssize_t result = real(s, buf, len, flags);
    fprintf(stderr, "< recv(s '%d', buf %p, len %lld, flags %d) return %lld\n",
            s, buf, len, flags, result);

    return result;
}

typedef int (*Connect)(int s, const struct sockaddr* serv_addr, socklen_t addrlen);

int connect(int s, const struct sockaddr* serv_addr, socklen_t addrlen)
{
    static Connect real = NULL;

    if (!real)
        real = (Connect)dlsym(RTLD_NEXT, "connect");

    fprintf(stderr, "> connect(s %d, sockaddr %p, addrlen %d)\n",
            s, (void*)serv_addr, addrlen);
    int result = real(s, serv_addr, addrlen);
    fprintf(stderr, "< connect(s %d, sockaddr %p, addrlen %d) return %d\n",
            s, (void*)serv_addr, addrlen, result);

    return result;
}

typedef int (*Accept)(int s, const struct sockaddr* serv_addr, socklen_t* addrlen);

int accept(int s, struct sockaddr* serv_addr, socklen_t* addrlen)
{
    static Accept real = NULL;

    if (!real)
        real = (Accept)dlsym(RTLD_NEXT, "accept");

    fprintf(stderr, "> accept(s %d, sockaddr %p, addrlen %p)\n",
            s, (void*)serv_addr, addrlen);
    int result = real(s, serv_addr, addrlen);
    fprintf(stderr, "< accept(s %d, sockaddr %p, addrlen %p -> %d) return %d\n",
            s, (void*)serv_addr, addrlen, *addrlen, result);

    return result;
}

Answer 1

一个想法,可能是用一个大锤来拍打飞行解决方案,就是使用库 插入.您基本上包装系统调用,连接和发送对您来说似乎是一个很好的起点,并记录在将数据传递给真实调用之前看到的参数.