Monitoring direct sockets with netlink inet_diag

Question

My goal is to track sockets and associate them with the applications that created them.
I know netstat, ss, lsof etc. And that they can list all the sockets with their application.
And I also know that I can parse /proc/net/tcp to get sockets and associate them with applications with /proc/(PID) , which is exactly what these tools do, or they use netlink sockets.

My research led me to an article that explains how to get all sockets from the kernel using netlink via the inet_diag protocol. The user space program installs a netlink socket of type inet_diag and sends the request to the kernel. The response consists of several messages containing sockets and additional relevant information.
This is really neat, but, unfortunately, the kernel sends this information only once per request. Therefore, I must constantly “interrogate”.

Further research led me to another article which constantly monitors IP interface changes using netlink network routes. A socket is bound to a multicast group, and then messages are read from it in an endless loop.

So, I investigated if there is such a possibility with inet_diag sockets. Unfortunately, I cannot understand the kernel code. But as far as I can tell, there are no multicast groups for this socket family.

At this moment I am stuck and I need to know how much this is possible, or someone knows any other hints.

Answer 1

You can try dtrace if all the tools you mentioned cannot satisfy your requirements.