socket-connect-bpf is a Linux command line utility that writes human-readable information about each application that makes new (network) connections to the standard output.

More sample output.

socket-connect-bpf is a BPF/eBPF prototype with a kernel probe attached to security_socket_connect. Connections to AF_UNSPEC and AF_UNIX are explicitly excluded.

Following information about each request is displayed if possible:

You might want to try socket-connect-bpf for the following use cases:

• Check if an application contains analytics.
• Check if your trusted dependencies communicate with the outside world.
• As a less invasive alternative to Kernel modules that provide the same functionality.

The socket-connect-bpf Go code is licensed under the Apache License. The BPF code is licensed under GPL as some BPF-helpers are GPL-only.

• x64/amd64 or AArch64/arm64 CPU
• Linux Kernel: 4.18 or later

Tested on following architecures:

• amd64 (Intel x64 CPU)
• arm64 (AWS Graviton2/Arm Neoverse-N1)

Instructions tested on Debian Bookworm with Linux Kernel 6.5:

• Extract the corresponding socket-connect-bpf-*.tar.gz release.

Tarballs can be verified with minisign and following public key:

RWRUqB/iFRENms4B2LbOrNGizwXbStkIPE8sUq01r63cXJP8kzHp+ITv

sudo ./socket-connect-bpf

Print all -a also prints the process arguments and the AS information.

sudo ./socket-connect-bpf -a

Information about an autonomous system (AS) that an IP address belongs to is not displayed by default. It can be turned on with the print all flag -a.

sudo ./socket-connect-bpf -a

AS data of IPtoASN is used. The local AS-Number lookup will require some more RAM.

To update the AS data used while developing run:

./updateASData.sh

Step-by-Step instructions for Debian Bookworm with Linux Kernel 6.5.0.

# Install Go 1.22 or later (if not already installed)
sudo snap install --classic go

# Install Clang 16 (for compiling the BPF sources)
sudo apt install clang-16

# Change into a folder of your choice and clone socket-connect-bpf
git clone https://github.com/p-/socket-connect-bpf.git

cd socket-connect-bpf

go generate
go build

Run tests:

go test ./...

VS Code or any other Go Lang IDE can be used for development.