How to report receive queue size for AF_UNIX sockets

I wrote a tool to capture and dump unix domain socket traffic. It uses bpf/kprobe to probe kernel function unix_stream_sendmsg and dump traffic to user space.

The tool depends on bcc, so you need to install bcc first.

An example run:

$ sudo ./sockdump.py /var/run/docker.sock # run "docker ps" in another terminal
>>> docker[3412] len 83
GET /_ping HTTP/1.1
Host: docker
User-Agent: Docker-Client/18.06.1-ce (linux)

>>> dockerd[370] len 215
HTTP/1.1 200 OK
Api-Version: 1.38
Docker-Experimental: false
Ostype: linux
Server: Docker/18.06.1-ce (linux)
Date: Tue, 25 Sep 2018 07:05:03 GMT
Content-Length: 2
Content-Type: text/plain; charset=utf-8

OK
...

On Linux you can look through the /proc filesystem specifically for a given PID under /proc/<pid>/fd. All the file descriptors (fd) are listed there per process.

Example

$ ls -l /proc/27634/fd/
total 0
lrwx------ 1 root root 64 Mar 17 20:09 0 -> /dev/null
lrwx------ 1 root root 64 Mar 17 20:09 1 -> /dev/null
lrwx------ 1 root root 64 Mar 17 20:10 10 -> /dev/ptmx
lrwx------ 1 root root 64 Mar 17 20:10 12 -> /dev/ptmx
lrwx------ 1 root root 64 Mar 17 20:10 13 -> /dev/ptmx
lrwx------ 1 root root 64 Mar 17 20:09 2 -> /dev/null
lr-x------ 1 root root 64 Mar 17 20:09 3 -> socket:[430396]
l-wx------ 1 root root 64 Mar 17 20:09 4 -> socket:[430437]
lrwx------ 1 root root 64 Mar 17 20:09 5 -> pipe:[430440]
l-wx------ 1 root root 64 Mar 17 20:10 6 -> pipe:[430440]
lrwx------ 1 root root 64 Mar 17 20:10 7 -> socket:[430443]
lrwx------ 1 root root 64 Mar 17 20:10 8 -> socket:[430444]
lrwx------ 1 root root 64 Mar 17 20:10 9 -> socket:[430446]

Everything listed there as socket:[....] is a socket.