2

I'm not very familiar with Solaris, so maybe there are tools that I don't know about. I need to debug the communication between two components on the same machine, talking to each other using a normal TCP socket.

Now there seem to be two tools available, one known from linux called tcpdump, the other one being a solaris utility called snoop. Unfortunately, at the client's site, there are a lot of restrictions and whatnot, so using these tools is not allowed / possible.

So, what I figured is that I could change the listening port of the server process to something else and have a tool like netcat act as a proxy on the actual port while forwarding the traffic to the "real" server process, so I can dump the communication between those components.

Is there a tool that does this - preferably outputting a known format like tcpdump's? Or how else would you go about this?

2
  • Are you using Solaris 10 or later?
    – Tom Shaw
    Jun 10, 2011 at 10:26
  • It's Solaris 10.
    – Dave Vogt
    Jun 10, 2011 at 11:07

2 Answers 2

1

snoop is not an option anyway because it won't work for traffic between two processes on the same host.

DTrace is your best bet. For example, here is a script for capturing traffic between two processes on the same server in snoop format. However, this particular script relies on the internal workings of the kernel so it may or may not work with your version of Solaris 10.

1

change the listening port of the server process to something else and have a tool like netcat

netcat will do the port forwarding - but not logging the info. However the suorce code is widely available - so if your C skills are up to it, it would be straightforward to add this in. If the prefer Perl - then there's several port forwarders written using that. There's a cpan module here.

If the data is travelling across a network and you have physical access to the network (at a point where the data is not encrypted) then you could use wireshark.

2
  • Unfortunately, this happens in a high-security environment, where (if even possible) it would not be allowed to have tools like wireshark around. +1 however on the CPAN link, maybe this could be used.
    – Dave Vogt
    Jun 10, 2011 at 13:11
  • @Dave Vogt, I am still puzzling over why it's acceptable to write your own tool (potentially buggy, with unintended 0-day exploits, and no widespread code review) instead of using something open-source (like wireshark) to do presumably the exact same thing. Jun 10, 2011 at 14:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .