Way to watch network activity of another linux process in C

Question

I'm need to start some helper processes when web interface of mine router is being used, and shut them down after some time, if activity in webface was stopped (to save RAM when webface isn't used).

Is there any way (except prace() ) to know, when another process (server) accepted any network connection?

I'm tried to parse /proc/net/tcp for socket inodes placed in /proc/pidof httpd/fd but it is very unrelaible, and catch only full webface reloading, but not navigating over it.

Here is source I written this way: https://dl.dropboxusercontent.com/u/100376233/zyxel/nethelperd.tar.bz2

OR: is there any way to catch only accept() syscall using ptrace() and not disturb traced process if it's called another syscall?

Answer 1

I would recommend that you use libpcap with a filter such as tcp port X, where X is the port hosting the web interface. Whenever you receive a packet, you can reset your timer. If the timer fires before you receive a packet, you can shut down the services. You can also reduce the overhead of this by not capturing the whole packet. libpcap allows you to specify the maximum number of bytes to capture per packet.