Kind of hard to explain but I noticed when
straceing the PID that has the socket open I cannot see any of the communication. How can I sit in the middle of a socket file to watch communication?
sockets are a kernel API for communication. Using the socket API, you can exchange data between two endpoints over TCP/IP connections, SCTP associations, UDP datagrams, or between two processes (datagram or connection) using Unix domain sockets...
Being a kernel API, any interaction with a socket is via system calls (
strace will be able to trace those because
strace traces system calls. The only communication mechanism that
strace can't trace is IPC over shared memory (because reading/writing something in memory obviously doesn't involve a system call).
More likely, in your case, it's something else. My bet would be that the application is multi-threaded and you're not stracing the right thread. Or it could be that the application is setuid/setgid and not started as superuser.
If you want to strace what's being exchanged over Unix domain sockets, the options are:
ptracedebugger (trace the server or the clients)
- The audit system (
auditctl), again that traces the system calls
- use a
LD_PRELOADtrick to wrap the system calls that interact with the socket
- instrument the code of the application to add logging there.
- systemtap and other low level kernel tracing/debugging systems as already mentioned
- insert a man in the middle.
For the MITM, you could for instance use
socat. Here for a connection oriented Unix domain socket like for X11:
socat -x unix-listen:/tmp/.X11-unix/X42,fork unix:/tmp/.X11-unix/X0 DISPLAY=:42 xlogo
Then, you see the X11 traffic that
xlogo and the X server exchange.
You can't "strace a socket", strace works on processes, so you can strace all processes that talk to the socket, but you can't use strace to see absolutely all communication involving the socket. You may be able to get somewhere with dtrace or systemtap if they're available on your OS, but that's quite a bit of work.