On 12/6/2013 11:34 AM, m.roth@5-cent.us wrote:
If you know the process, you could use strace.
that will only show user mode calls, which are basically select() and read(). as I said, the packet transversal is all done in the network related kernel modules, under the covers where strace can't see it. you'd need to use a kernel debugger to follow it, and good luck.