_ ReconLab
Commands  / Reverse Engineering  / strace

strace

Trace system calls and signals.

KaliParrotLinuxpassive

pkg: strace

strace logs the syscalls a process makes — revealing file/network access and behaviour without source code.

Syntax

strace [-f -e trace=...] {command}

Example

strace -f -e trace=network ./binary

Follows child processes (-f) and shows only network-related syscalls.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

-fFollow child processes (forks).
-e <trace=network>Filter syscalls, e.g. trace=network,file.
-p <1234>Attach to a running PID.
-o <trace.txt>Write trace to a file.
-cSummarise syscall counts/time.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

strace

Usage examples

strace -f -e trace=network ./binary

Trace only network syscalls.

strace -c ./binary

Profile which syscalls are used most.

Advantages
  • Black-box behaviour insight
  • Filters by syscall group
  • Great for debugging/malware triage
Disadvantages
  • Big slowdown of the traced program
  • Verbose output
  • Linux syscall focus
Tags
#syscalls#dynamic

Official docs: strace ↗

Related commands

GDB

The GNU debugger.

ltrace

Trace library/function calls.

Frequently asked questions

What is strace used for?
strace logs the syscalls a process makes — revealing file/network access and behaviour without source code.
What is an example strace command?
A common example is: strace -f -e trace=network ./binary — Follows child processes (-f) and shows only network-related syscalls.
Is strace part of Kali Linux?
Yes. strace ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install strace.
What category of security tool is strace?
strace is a Reverse Engineering tool with a passive-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →