Networked applications interact with the TCP/IP stack through the socket API. Over the years, various extensions have been added to this popular API. In this paper, we propose and implement the TCPSnitch software that tracks the interactions between Linux and Android applications and the TCP/IP stack. We collect a dataset containing the interactions produced by more than 120 different applications. Our analysis reveals that applications use a variety of API calls. On Android, many applications use various socket options even if the Java API does not expose them directly. TCPSnitch and the associated dataset are publicly available.
@article{arxiv.1711.00674,
title = {TCPSnitch: Dissecting the Usage of the Socket API},
author = {Gregory Vander Schueren and Quentin De Coninck and Olivier Bonaventure},
journal= {arXiv preprint arXiv:1711.00674},
year = {2017}
}