[Paper Review] TCPSnitch: Dissecting the Usage of the Socket API

Gregory Vander Schueren, Quentin De Coninck+1 more|arXiv (Cornell University)|Nov 2, 2017

Advanced Malware Detection Techniques13 references3 citations

TL;DR

TCPSnitch is a system that intercepts and logs detailed interactions between Android and Linux applications and the TCP/IP stack, capturing system call parameters, timestamps, and socket options. The study reveals widespread, non-standard use of socket options—especially TCP_INFO—by popular apps like Facebook and YouTube, despite their absence in the standard Java API, highlighting a gap between high-level abstractions and low-level system usage.

ABSTRACT

Networked applications interact with the TCP/IP stack through the socket API. Over the years, various extensions have been added to this popular API. In this paper, we propose and implement the TCPSnitch software that tracks the interactions between Linux and Android applications and the TCP/IP stack. We collect a dataset containing the interactions produced by more than 120 different applications. Our analysis reveals that applications use a variety of API calls. On Android, many applications use various socket options even if the Java API does not expose them directly. TCPSnitch and the associated dataset are publicly available.

Motivation & Objective

• To understand how real-world networked applications actually use the socket API on Android and Linux.
• To identify discrepancies between high-level programming abstractions (e.g., Java APIs) and low-level system calls.
• To collect and expose a large-scale, parameter-rich dataset of socket system call traces for research.
• To analyze the actual usage patterns of socket options, including non-standard ones like TCP_INFO.
• To support the design of future generic transport services by revealing real application needs.

Proposed method

• TCPSnitch uses LD_PRELOAD to intercept 40 key network-related functions in the C library, including socket, connect, send, recv, and getsockopt.
• It logs detailed metadata: timestamps, function parameters, return values, thread IDs, and system configuration.
• Traces are uploaded to a public database at https://tcpsnitch.org, exposing visualizations and query interfaces.
• The system was deployed on 90 popular Android applications and Linux systems, collecting over 2.3 million system calls.
• The dataset includes socket options, buffer sizes, and flag usage, enabling fine-grained analysis of API behavior.
• The web interface allows researchers to browse traces, filter by application or socket option, and explore usage patterns.

Experimental results

Research questions

• RQ1 How do real-world Android and Linux applications use the socket API in practice, particularly in terms of system call sequences and parameters?
• RQ2 To what extent do applications use non-standard socket options—especially those not exposed by the Java API—on Android?
• RQ3 What patterns emerge in connection establishment and termination, particularly regarding the use of SO_LINGER and SO_DEBUG?
• RQ4 How frequently are advanced socket options like TCP_INFO used, and what is their distribution across different applications and connection lifetimes?
• RQ5 What is the actual usage of UDP sockets in Android apps, and how does it compare to their intended use?

Key findings

• In IPv6-enabled WiFi networks, Android applications prefer IPv6 over IPv4, with 78% of connections using IPv6.
• UDP sockets are predominantly used as a lightweight mechanism to probe network configuration, not for actual data transfer.
• A consistent pattern emerges in TCP connection lifecycle: applications use getsockopt(SO_LINGER) and getsockopt(SO_DEBUG) before close() to detect and handle socket-specific cleanup.
• 28 Android applications use the non-standard TCP_INFO socket option, which exposes internal TCP stack counters, with 26% of TCP_STREAM sockets retrieving it at least once.
• Facebook, Messenger, and Instagram issue TCP_INFO up to 3,000 times per connection, with calls uniformly distributed over time, not just at start or end.
• Despite being non-standard and not exposed in the Java API, TCP_INFO is used by high-traffic apps like YouTube, Chrome, and Spotify, indicating a significant gap between high-level abstractions and low-level system access.