I'm interested in knowing what happens at the kernel level when an application makes a network request. While playing with strace I was hoping to find system calls like connect() to make a connection with an IP socket but instead, I found connections to local Unix sockets. From what I understand these connections may be for logging or any other system service. A lot of ioctl calls were also made which I'm guessing were for binder communication.

If the application is not servicing the request, is it being passed on to a system service using IPC which then sends back the response to the application? I was wondering if these requests could be captured at the system level using ptrace in order to monitor/block them.

I'm using a rooted device running Android 7.1.2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.