Skip to content

Instantly share code, notes, and snippets.

@XSAM
Forked from jhass/dump_socket.sh
Created March 15, 2018 08:16
Show Gist options
  • Save XSAM/8d0f36fdf8be5e500292a1450a7efb30 to your computer and use it in GitHub Desktop.
Save XSAM/8d0f36fdf8be5e500292a1450a7efb30 to your computer and use it in GitHub Desktop.
Capture unix socket to pcap file with socat and tshark
#!/bin/bash
# Parameters
socket="/run/foo.sock"
dump="/tmp/capture.pcap"
# Extract repetition
port=9876
source_socket="$(dirname "${socket}")/$(basename "${socket}").orig"
# Move socket files
mv "${socket}" "${source_socket}"
trap "{ rm '${socket}'; mv '${source_socket}' '${socket}'; }" EXIT
# Setup pipe over TCP that we can tap into
socat -t100 "TCP-LISTEN:${port},reuseaddr,fork" "UNIX-CONNECT:${source_socket}" &
socat -t100 "UNIX-LISTEN:${socket},mode=777,reuseaddr,fork" "TCP:localhost:${port}" &
# Record traffic
tshark -i lo -w "${dump}" -F pcapng "dst port ${port} or src port ${port}"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment