I have a closed-source VPN program that messes up my system (Fedora Linux): I run it, it changes something, VPN works, but when I terminate the connection, my system is left in a dirty state and the networking is broken (DNS in particular, even though /etc/resolv.conf is restored correctly).

I would like to keep track of what changes are made by that program (which is a Java program with GUI, if I am not mistaken) on my system. This should include at least file system and networking configuration.

I thought about using strace, but the output is probably too messy and low-level to let me understand what is happening. Also I found fssb which could be nice at fs level, but I still need to understand what's going on the network configuration and I don't know what tool to use.

What tools I can use?

  • 1
    Hi @roaima and thanks for your suggestion! Sadly, it is something deeper because /etc/resolve.conf is restored correctly. – The Data Scientician Mar 11 at 9:13
  • Any chances you are using LVM? If so, you could make a snapshot and compare it to the changed file system. – nox Mar 11 at 9:20
  • It is a possibility, yes, but can I compare two snapshots? – The Data Scientician Mar 11 at 10:27
  • I think this answer should help you: linux diff tools: create list of modified files – domaniqs Mar 11 at 11:38

One thing I would suggest is to run "ip ro", "ip ad", and "iptables-save" before and after, and compare. DNS going bad even though resolv.conf is back indicates the VPN may have broken UDP traffic; perhaps it tries to prevent UDP while it is active, and forgets to restore it properly, or something like that.

I also find it useful to run "git init" in /etc, save everything ("git add .; git commit -m start"), and then -- after some suspected changes, check with "git diff" what it might be. You may be surprised to find something has changed which you did not expect. I'd also look for symbolic links within /etc that point outside /etc; changes there may not show up in the git-diff.

Finally, strace is actually very customisable. For example, "strace -f -e trace=%file -o strace.log my-command [args]" gets you only file operations. You can further subset the output by, after the program is done, examining only lines that use some variant of the open() system call.

  • Wow, this is a very good answer! If I could upvote, I would :) Thanks a lot, I will report any progress. – The Data Scientician Mar 14 at 14:50
  • Apparently, only iptables changes significantly (in etc only a couples of pid files changed, relative to VPN software, and no changes was made in symlinked files). ip routes and address are the same. I did not check strace, but I will if iptables inspection leads to nothing interesting – The Data Scientician Mar 14 at 15:04
  • No, I was mistaken: iptables rules are the same and only counters changed. I also tested changes in ip link, but the ppp0 is removed correctly after the connection is closed. – The Data Scientician Mar 14 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.