On 12/6/2013 11:34 AM, m.roth at 5-cent.us wrote: > If you know the process, you could use strace. that will only show user mode calls, which are basically select() and read(). as I said, the packet transversal is all done in the network related kernel modules, under the covers where strace can't see it. you'd need to use a kernel debugger to follow it, and good luck. -- john r pierce 37N 122W somewhere on the middle of the left coast