2026-11-05 –, Ballroom Salon A Language: English
Every Linux engineer knows the moment: a process is misbehaving, so you reach for strace, get a wall of text, and start grepping. It works - until the problem spans multiple processes, the output is too much to read, or you need to correlate what a process did to the system with what it did on the network. strace and bpftrace are excellent at capturing syscalls.
Stratoshark takes a different approach: it captures system calls and logs system-wide through the Falco libraries, then hands them to the same analysis engine that has served packet analysts for 25 years — display filters, coloring rules, follow-stream views, time correlation, and shareable capture files.
In this talk I'll show how a Wireshark user's instincts transfer directly to syscall troubleshooting, where Stratoshark beats reaching for strace, and where the older tools are still the right call. Real debugging scenarios, honest limitations, and a clear picture of when this newer approach earns its place in your toolbox.
