Skip to content

Instantly share code, notes, and snippets.

@zulonas
Forked from jhass/dump_socket.sh
Created June 9, 2021 08:09
Show Gist options
  • Save zulonas/5f0ab953a95d60be2db4c8963f9ab6ce to your computer and use it in GitHub Desktop.
Save zulonas/5f0ab953a95d60be2db4c8963f9ab6ce to your computer and use it in GitHub Desktop.
Capture unix socket to pcap file with socat and tshark
#!/bin/bash
# Parameters
socket="/run/foo.sock"
dump="/tmp/capture.pcap"
# Extract repetition
port=9876
source_socket="$(dirname "${socket}")/$(basename "${socket}").orig"
# Move socket files
mv "${socket}" "${source_socket}"
trap "{ rm '${socket}'; mv '${source_socket}' '${socket}'; }" EXIT
# Setup pipe over TCP that we can tap into
socat -t100 "TCP-LISTEN:${port},reuseaddr,fork" "UNIX-CONNECT:${source_socket}" &
socat -t100 "UNIX-LISTEN:${socket},mode=777,reuseaddr,fork" "TCP:localhost:${port}" &
# Record traffic
tshark -i lo -w "${dump}" -F pcapng "dst port ${port} or src port ${port}"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment