Linux system tips (6): Combining wireshark and strace

Summary: Capturing packets alone or using strace to trace the execution path of a process can solve many problems. So, what about team fighting if you combine the two?

The following is unfinished, and will be supplemented in the future.

First declare that wireshark here can be replaced by tcpdump.

Wireshark and strace, for hackers, are must-haves in the toolbox. Engineers who have experience in troubleshooting and diagnosis, who has no experience in capturing and analyzing packets?

Relatively speaking, strace is less famous. After all, there are not many people who are conscious and capable of tracing the execution path of a process. And there are more than 20 common system calls.

Let's use a diagram to see the location of the system call

unix_system_block.

So, we can capture packets at both ends, track the execution path of the process at the same time, and hook the execution path and network flow behavior through time. All you need is to let strace give the timestamp

strace -f -ff -s 256 -tt -o strace.log your_program
This article is the original content of the Yunqi community and cannot be reproduced without permission. If you need to reprint, please send an email to yqeditor@ list.alibaba-inc.com; if you find any content suspected of plagiarism in this community, please send an email to: [email protected] to report and provide relevant evidence. Once verified, this community will immediately delete the suspected infringement content.