move the socket ```sh # mv /var/run/docker.sock /var/run/docker.sock.original ``` redirect all socket communications to a tcp listener in port 1234 ```sh # socat TCP-LISTEN:1234,reuseaddr,fork UNIX-CONNECT:/var/run/docker.sock.original ``` create a new proxy socket to be use by the application ```sh # socat UNIX-LISTEN:/var/run/docker.sock,fork TCP-CONNECT:127.0.0.1:1234 ``` sniff the traffic ```sh # tcpdump -i lo -netvv port 1234