Capturing all traffic from a process?

Hello,

Is anyone aware of an existing solution to capture ALL
traffic created or received by a particular local process?

What I have in mind are two scenarios like (on Linux 2.6):

"ethereal --process firefox-bin (or pid)":
1. Find processes with this name (e.g. using pidof(8)).
2. Find all existing network file descriptors this process
(and its children?) have and build a "filter" which will
listen on their addresses.
3. Attach to these processes (a-la strace(1)).
4. Through system call tracking, keep a watch whenever this process
accepts or initiates a new connection and adjust the filter to
catch the traffic on this connection.

Another variation on this might be:
"ethereal --run firefox":
1. Do whatever strace does to run this program and catch all
network calls it does.
2. Continue as in point (4) in the previous scenario.

The "--run" and "--process" criteria may be added to other
filter expressions so, e.g. only tcp connections to port 80
from this process will be captured.

The possible advantage of the second scenario might be that
it will be able to catch traffic "from the first byte", as
oppose to the first one which might miss traffic generated
by existing processes.

This is it.

I have a strong feeling that this should be doable with some
scripting on top of ethereal/tcpdump/strace and /proc, but
I also suspect that:

1. There is a good chance someone has already implemented it
(that's why I ask here).
2. It might be too heavy on a shell script and may be better
off merging it into an existing tool.

Any thoughts?

Cheers,

--Amos