System Call Multiplexing Some "system calls" are actually multiplexers for several functions. For example, 'socketcall' is a multiplexer for all socket-related functions: socket, accept, connect, listen, shutdown, recv, send... Handling those required special handling, since we wanted to expose the muxed functions (not the muxing syscall) to users. Our solution was to encode the function ID inside the syscall ID, and have the kernel module break the number down, and apply rules to sub-functions, rather then to the syscall itself. For that to work, we needed to copy the kernel's mux syscall and make our own copy, that calls our functions, instead of the original system call.