Auditing network traffic

Hello, I work on an audisp plugin which audits network traffic – what process has send/received data to/from what remote address. So far I see 2 ways of accomplishing that: Hook syscalls. First, hook socket call with af_inet/inet6 to get pid and fd, then read/write/sendto/recvfrom filtered by pid and fd. I see few issues with this appoach: 1) Fd can be closed or duped, so I should probably hook close/dup2 calls too. Not sure, though, if socket could be closed by kernel without any syscall. As a workaroud, one can just hook read/write and check if fd is socket (S_ISSOCK) and also somehow filter out af_unix. 2) Getting saddr/daddr. Seems that dest addr could be obtained from connect call. However I am not sure what is the right way to get that - I got two records, first SYSCALL and then SOCKADDR. First one has an argument which points to memory location where sockaddr structure lays, and second one has ”saddr” field. Latter looks good, but does SOCKADDR event type always follows SYSCALL for connect call? Same for sendto call. Another way of getting network stats is the AUDIT target for netfilter. Looks good, no need to worry about fds/addrs. However there is no pid. What would be the ”best” way to get pid for those records? Anything else besides looking into /proc/net/tcp? -Lev