getsockname¶

Intro¶

getsockname - get the name of the socket and the local address of a socket.

Description¶

The getsockname() function retrieves the current address to which the socket 'sockfd' is bound, and stores it in the sockaddr structure pointed to by the 'addr' argument. The 'addrlen' argument should be initialized to indicate the amount of space pointed to by 'addr'. On return it contains the actual size of the socket address.

The getsockname() function provides the address of an unnamed socket, the address of a named socket that has not yet been bound to an address, or the address of a bound stream-oriented socket.

There are not many advantages of using getsockname() over other socket functions, but one of the benefits is that a socket can be used to obtain the local address even before bind() is called.

Arguments¶

sockfd:int[K] - Socket file descriptor.
addr:struct sockaddr*[U] - Pointer to a sockaddr type that will be filled with the local address.
addrlen:int*[U] - Pointer to the size of the sockaddr struct.

Available Tags¶

K - Originated from kernel-space.
U - Originated from user space (for example, pointer to user space memory used to get it)

Hooks¶

sys_getsockname¶

Type¶

Kprobes

Purpose¶

Trace calls to sys_getsockname to get information about the local address.

Example Use Case¶

This event can be used to monitor incoming and outgoing connections to a socket.

Issues¶

This event may omit some addresses if they are not set yet, or if they are not bound to a socket yet.

bind()
connect()
getpeername()

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.