Trace network system calls from a running Linux process
Build a paste-ready command, then review its compatibility and effects before running it.
sudo strace -f -p <process-id> -e trace=%network -s 256Complete required fields to copy the generated command.
cautionrequires privileges Compatibility
Linux ptraceAttaching can briefly pause threads and add overhead. Detach with Ctrl+C without terminating the traced process.
Operational knowledgereview due 2027-01-19
Requirementsstracestrace must be installed and available on PATH.Elevated accessReview the exact scope before using an elevated account.
Version supportstrace Current supported releasesVerified for linux using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalsstrace: Process 1842 attachedRepresentative successful output; values vary with the selected target and system state.
Known errorsstrace: command not foundstrace is missing or is not available on PATH.Permission deniedThe current identity does not have the required access.
Verifysudo strace -f -p {{pid}} -e trace=%network -s 256Re-run the corresponding read-only inspection and confirm the intended state.Rollback noteNo universal automatic rollback is available. Capture the current state and use the tool-specific recovery procedure before applying changes.
Command breakdown
01sudoPrivilege elevationRuns the following command with elevated privileges after authorization.
02straceCommandRuns the strace stage of this one-liner.
03-fOptionFollows child processes and threads created by the traced process.
04-pOptionAttaches strace to the process with the following PID.
05<process-id>ParameterA value supplied in the Fill parameters section.
06-eOptionApplies the following syscall trace or return-status filter expression.
07trace=%networkArgumentPasses trace=%network to strace.
08-sOptionCaptures up to the specified number of bytes from printed strings.
09256ArgumentPasses 256 to strace.
Example input
sudo strace -f -p 1842 -e trace=%network -s 256
Example output
strace: Process 1842 attached
[pid 1842] accept4(7, {sa_family=AF_INET, sin_port=htons(51128), sin_addr=inet_addr("203.0.113.42")}, [16], SOCK_CLOEXEC) = 12
[pid 1842] recvfrom(12, "GET /health HTTP/1.1\r\n", 256, 0, NULL, NULL) = 22
Illustrative output — exact values vary by system and data.
Official sources
Related commands