Beyond strace: Syscall Analysis the Wireshark Way

Every Linux engineer knows the moment: a process is misbehaving, so you reach for strace, get a wall of text, and start grepping. It works - until the problem spans multiple processes, the output is too much to read, or you need to correlate what a process did to the system with what it did on the network. strace and bpftrace are excellent at capturing syscalls. They give you much less help analyzing them.

Stratoshark, the Wireshark Foundation's newer tool, takes a different approach: it captures system calls and logs system-wide through the Falco libraries, then hands them to the same analysis engine that has served packet analysts for 25 years — display filters, coloring rules, follow-stream views, time correlation, and shareable capture files.

In this talk I'll show, live, how a Wireshark user's instincts transfer directly to syscall troubleshooting, where Stratoshark beats reaching for strace, and — just as importantly — where the older tools are still the right call. Expect real debugging scenarios, honest limitations, and a clear picture of when this newer approach earns its place in your toolbox.