current community

your communities

more stack exchange communities

Stack Exchange
tour help
careers 2.0
Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.
up vote -3 down vote favorite

So I am developing a Linux Kernel Module, and want to hide an open socket on a specific port number from the output of sudo netstat -nap

What is the approach that I should take?

share|improve this question
    
Your question is poorly phrased. Please take a look at how to ask. –  Jesse May 8 '13 at 0:40
    
@Jesse Give me a hand here. For the future, I will follow that. For now, if you can, give me a hand. –  user2360373 May 8 '13 at 0:43
    
Run 'strace netstat -nap' to see the system calls that are made. Looks like it is getting much of this info from /proc/net/tcp and the other tables. The kernel net stack is putting this info there, so you would likely have to filter there. Obviously, this is not a recommended practice. I have not looked into which file(s) you would need to touch, but likely under linux/net/ in the kernel source (start with the proc handler). –  Peter L. May 8 '13 at 0:49
    
@user2360373 I would help, but unfortunately, I haven't touched linux kernel modules outside of an university class. –  Jesse May 8 '13 at 1:38
2  
Why would you want to do that? System administrators would hate you! –  undefined behaviour May 8 '13 at 3:13

1 Answer 1

up vote 0 down vote

First, you have to find out how "netstat" acquire socket state from system. It is said that it read from /proc/net/tcp. Then, find out the kernel module which write socket state into "/proc/net/tcp" and modify that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.