Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>It has been a while since I was dealing with this topic and did not actually get around to testing what an acquaintance of mine, <strong>Denys Vlasenko</strong>, maintainer of Busybox, proposed as a solution to me several months ago. Because I just checked my account here on StackOverflow and saw the question again, let me share his insights with you. Maybe it is helpful for somebody:</p> <blockquote> <p>One relatively easy hack I can propose is to do the following:</p> <p>I assume that you have a running server app which opened a Unix domain listening socket (say, <code>/tmp/some.socket</code>), and client programs connect to it and talk to the server.</p> <ul> <li>rename <code>/tmp/some.socket</code> -> <code>/tmp/some.socket1</code></li> <li>create a new socket /tmp/some.socket</li> <li>listen on it for new client connections</li> <li>for every such connection, open another connection to <code>/tmp/some.socket1</code> to original server process</li> <li>pump data (client&lt;->server) over resulting pairs of sockets (code to do so is very similar to what telnetd server does) until EOF from either side.</li> </ul> <p>While you are pumping data, it's easy to look at it, to save it, and even to modify it if you need to.</p> <p>The downside is that this sniffer program needs to be restarted every time the original server program is restarted.</p> </blockquote> <p>This is similar to what <strong>Celada</strong> also answered. Thanks to him as well! Denys's answer was a bit more concrete, though.</p> <p>I asked back:</p> <blockquote> <p>This sounds hacky, yes, because of the restart necessity, but feasible. Me not being a C programmer, I keep wondering though if you know a command line tool which could do the pass-through and protocolling or event-based triggering work for me. I have one guy from our project in mind who could hack a little C binary for that, but I am unsure if he likes to do it. If there is something pre-fab, I would prefer it. Can it even be done with a (combination of) BusyBox applet(s), maybe?</p> </blockquote> <p>Denys answered again:</p> <blockquote> <p>You need to build busybox with <code>CONFIG_FEATURE_UNIX_LOCAL=y</code>.</p> <p>Run the following as intercepting server:</p> <pre><code> busybox tcpsvd -vvvE local:/tmp/socket 0 ./script.sh </code></pre> <p>Where script.sh is a simple passthrough connection to the "original server":</p> <pre><code> #!/bin/sh busybox nc -o /tmp/hexdump.$$ local:/tmp/socket1 0 </code></pre> <p>As an example, I added hex logging to file (<code>-o FILE</code> option).</p> <p>Test it by running an emulated "original server":</p> <pre><code> busybox tcpsvd -vvvE local:/tmp/socket1 0 sh -c 'echo PID:$$' </code></pre> <p>and by connecting to "intercepting server":</p> <pre><code> echo Hello world | busybox nc local:/tmp/socket 0 </code></pre> <p>You should see "PID:19094" message and have a new <code>/tmp/hexdump.19093</code> file with the dumped data. Both tcpsvd processes should print some log too (they are run with <code>-vvv</code> verbosity).</p> <p>If you need more complex processing, replace nc invocation in <code>script.sh</code> with a custom program.</p> </blockquote>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload