TCP/IP and UDP captures can be made using tcpdump/dumpcap and produces a pcap/pcapng file which can be fed to Wireshark for further analysis. Does a similar tool exist for named Unix domain sockets? (A general solution that works for abstract sockets would be nice too though.)strace as-is is not sufficient, it is not straightforward to filter for Unix domain sockets I/O. A proxy using socat or alike is also not suitable as the goal is passive analysis for existing open programs.How can I obtain a packet capture that I can use in Wireshark for analysis? Example protocol applications are X11 (Xorg, my current application) and cURL/PHP (HTTP). I have seen a CONFIG_UNIX_DIAG option in the Linux kernel, is this of some use?
How to passively capture from Unix domain sockets (AF_UNIX socket monitoring)?
linux;debugging;unix sockets;pcap