title: How to passively monitor if a new TCP connection is being made in Linux?
body: <p>The easiest way is probably to write a loop to monitor /proc/net/tcp or /proc/net/tcp6. However, it is too inefficient since I need to be notified almost immediately. The closest thing I looked at is inotify which can provide callbacks on IO events on any files. The problem is that procfs is not regular file systems and inotify does not appear to support it (at least not for /proc/net/tcp and /proc/net/tcp6).</p>
  
  <p>Further, I do not want the program to have root privilege in order to implement this. </p>
  
  <p>EDIT: I removed the requirement of userspace connection. Also, I'm hoping that there's a built-in kernel support such as inotify that can achieve this. It may even be too intrusive in my case to manipulate the iptables.</p>
  
  <p>Anyone has any idea? Thanks!! </p>