{"repo":"pandaadir05/snoop","free":true,"listed":false,"github":"https://github.com/pandaadir05/snoop","clone":"git clone https://github.com/pandaadir05/snoop.git","description":"A modern syscall tracer built on eBPF. Think strace, but with a real TUI, smart filters, TLS decryption, and output that's actually readable.","language":"Rust","stars":220,"topics":["ebpf","linux","low-level","reverse-engineering","rust","syscall","tracer","tui","analysis","cybersecurity"],"license":"MIT","category":"security-tools","readme_excerpt":"snoop A syscall tracer for Linux, built on eBPF. Like strace but with a live TUI, smart filters, and argument decoding you can actually read. Or run it without --raw and get a full-screen TUI: Why not just use strace? strace uses ptrace, which stops your process on every syscall. snoop uses eBPF tracepoints instead -- your process keeps running at full speed with the tracing happening in-kernel. Beyond performance, snoop decodes arguments into something you can actually read, has a real-time TUI, and can save/replay/diff traces. What it does - TUI -- live scrollable syscall stream with a top-syscalls panel, search, category filters, pause/resume. Falls back to strace-style line output when stdout isn't a terminal. - Output formats -- --raw (strace-compatible), --json (JSON Lines for jq), --explain (groups syscalls into high-level activity summaries) - Filters -- --files , --net , --slow 10 , --syscall openat - Arg decoding for 60+ syscalls -- paths, flags, socket addresses, all the stuff you'd normally have to look up in the man page - Attach to a running process ( -p PID ) or spawn one ( snoop ) - --follow traces forked children too - Containers -- --docker and --pod trace everything inside a container - TLS capture -- --tls hooks SSL write / SSL read via uprobes to show plaintext - Heap tracing -- --ltrace tracks malloc / free / calloc / realloc - Record & replay -- snoop record saves to disk, snoop view replays offline (no root needed) - Diff -- snoop diff before.snoop aft","default_branch":null,"files":null,"tree":[],"storefront":"/r/pandaadir05","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/pandaadir05/snoop/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}