Hiding from netstat

[James2516]

Can someone provide some guidance on what needs to be modified to hide from netstat?
Thank you.

[gianlucaborello]

netstat typically reads network information from the /proc file system. For example, TCP network connections for the current network namespace are under /proc/net/tcp. If you intercept the I/O activity towards that file (you can look at the netstat source code for more details) and implement your own filtering, it should be doable. An LD_PRELOAD approach might not be the best way to proceed though, this repo was mostly implemented as a proof of concept.