Building — proc-trace-net

Build Methods

🐳 Docker Recommended

No local Go install required. Produces static binaries for amd64 and arm64 in one command via build.sh.

⚡ Quick Build Go required

One line with a local Go install. Output is a native binary for your current platform.

📦 Static Binary Go required

Fully static with CGO_ENABLED=0. Copy the binary to any Linux system of the same architecture — no runtime dependencies.

Requirements

Kernel & Runtime

proc-trace-net uses the Linux conntrack netlink socket — a standard kernel interface available on virtually every modern distribution that runs Docker, iptables, or nftables.

Requirement	Details	Status
Linux kernel ≥ 3.6	conntrack multicast groups stable since 3.x. Any distro running Docker or iptables qualifies.	✓ universal
CONFIG_NF_CONNTRACK=y	Standard on Ubuntu, Debian, Fedora, RHEL, Arch, Alpine — any system using iptables/nftables/Docker.	✓ default on
CAP_NET_ADMIN	Required to bind the conntrack netlink socket. Run as root, or grant with `setcap`.	✓ root / setcap
Go 1.22+	Only needed for the from-source build methods. The Docker build uses `golang:1.22-alpine` internally.	✓ optional
Docker	Only needed for the `build.sh` Docker method. Any recent Docker Engine with buildx support works.	✓ optional

Method 1 — Docker (Recommended)

Multi-arch build via `build.sh`

Clones the repo, runs the build inside a golang:1.22-alpine container, and drops two static binaries into ./dist/ — no local Go toolchain needed.

Clone the repo

Gets the source and the build.sh script.
Mark build.sh executable and run it

The script handles everything: image pull, cross-compilation for both architectures, and output placement.
Find your binary in ./dist/

Copy the right arch binary to /usr/local/bin/ or wherever you like.

build.sh — docker cross-compile

# Clone
❯ git clone https://github.com/binRick/proc-trace-net.git
❯ cd proc-trace-net

# Build
❯ chmod +x build.sh
❯ ./build.sh
Building proc-trace-net ...
  → linux/amd64
  → linux/arm64
Done. Binaries in ./dist/:
  proc-trace-net-linux-amd64  (3.8 MB)
  proc-trace-net-linux-arm64  (3.6 MB)

# Install
❯ sudo cp dist/proc-trace-net-linux-amd64 /usr/local/bin/proc-trace-net
❯ proc-trace-net -h
🌐 proc-trace-net dev — system-wide network connection tracer for Linux

Method 2 — From Source

With local Go install

If you already have Go 1.22+ installed, this is the fastest path. Use CGO_ENABLED=0 and strip flags for a fully static binary with no runtime dependencies.

go build — static

❯ git clone https://github.com/binRick/proc-trace-net.git
❯ cd proc-trace-net
❯ CGO_ENABLED=0 go build -ldflags="-s -w" -o proc-trace-net .
❯ sudo mv proc-trace-net /usr/local/bin/

# Confirm: no dynamic libraries
❯ file proc-trace-net
proc-trace-net: ELF 64-bit LSB executable, x86-64, statically linked, stripped

Cross-Compilation

Build for a different architecture

Go's built-in cross-compilation support makes it trivial to build binaries for other Linux architectures. Set GOOS and GOARCH before building.

Target	GOOS	GOARCH	Command
Linux x86-64	`linux`	`amd64`	`GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o proc-trace-net-linux-amd64 .`
Linux arm64	`linux`	`arm64`	`GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -ldflags="-s -w" -o proc-trace-net-linux-arm64 .`

Note: proc-trace-net uses NETLINK_NETFILTER which is Linux-specific. Cross-compiling for non-Linux targets will succeed but the binary will not run.

Build Flags Explained

What the flags do

The recommended build uses a specific set of Go flags. Here's what each one does.

CGO_ENABLED=0 Disables CGo, forcing a purely Go build with no C library linkage. The resulting binary is fully static — no libc, no runtime dependencies. Copy it to any Linux system and it runs.

-ldflags="-s -w" -s strips the symbol table; -w strips DWARF debug information. Together they reduce binary size by ~30% with no impact on runtime behavior.

-trimpath Removes local filesystem paths from the binary (optional). Useful for reproducible builds and to avoid leaking your build directory structure in stack traces.

Running Without sudo

Grant `CAP_NET_ADMIN` with `setcap`

Instead of running as root every time, you can grant the specific capability the tool needs. The binary will be usable by any user on the system.

setcap — drop root requirement

# Grant the capability (one-time, as root)
❯ sudo setcap cap_net_admin+eip /usr/local/bin/proc-trace-net

# Verify
❯ getcap /usr/local/bin/proc-trace-net
/usr/local/bin/proc-trace-net cap_net_admin=eip

# Now run as a normal user
❯ proc-trace-net -ct
3892 curl  TCP  10.0.2.15:54321  →  93.184.216.34:443

Building from Source