On Tuesday, January 13, 2015 12:13:16 PM hsultan(a)thefroid.net wrote: This is expected. The 32 bit ABI for x86 is very old. For whatever reason, they decided that dedicating a syscall to each networking call was unreasonable and its all done through the socketcall(2) system call. To audit those calls, you would have to look up the define for each one include/linux/net.h and use that number for arg0. -Steve