// This defines subroutine (function) named doit function doit { // Log PID of process which is using network log "Process pid is using network "; // Here you can (dis)allow network connection, // change capabilities .... } // when syscall event raised on syscall { if (action == 102) { // If it's // socketcall, see man 2 // socketcall if ( trace1 == 1 /* SYS_SOCKET */ and lpeek trace2 $x /* verify_area() */ and $x == 2 /* PF_INET */ ) { // It's opening inet socket => call function doit doit; } else // Other syscalls are not interesting => // switch off tracing for them trace_off action; }