---

tcpv4connect.py

#!/usr/bin/python # # tcpv4connect Trace TCP IPv4 connect()s. # For Linux, uses BCC, eBPF. Embedded C. # # USAGE: tcpv4connect [-h] [-t] [-p PID] # # This is provided as a basic example of TCP connection & socket tracing. # # All IPv4 connection attempts are traced, even if they ultimately fail. # # Copyright (c) 2015 Brendan Gregg. # Licensed under the Apache License, Version 2.0 (the "License") # # 15-Oct-2015 Brendan Gregg Created this. from __future__ import print_function from bcc import BPF from bcc.utils import printb # define BPF program bpf_text = """ #include <uapi/linux/ptrace.h> #include <net/sock.h> #include <bcc/proto.h> BPF_HASH(currsock, u32, struct sock *); int kprobe__tcp_v4_connect(struct pt_regs *ctx, struct sock *sk) { u32 pid = bpf_get_current_pid_tgid(); // stash the sock ptr for lookup on return currsock.update(&pid, &sk); return 0; }; int kretprobe__tcp_v4_connect(struct pt_regs *ctx) { int ret = PT_REGS_RC(ctx); u32 pid = bpf_get_current_pid_tgid(); struct sock **skpp; skpp = currsock.lookup(&pid); if (skpp == 0) { return 0; // missed entry } if (ret != 0) { // failed to send SYNC packet, may not have populated // socket __sk_common.{skc_rcv_saddr, ...} currsock.delete(&pid); return 0; } // pull in details struct sock *skp = *skpp; u32 saddr = skp->__sk_common.skc_rcv_saddr; u32 daddr = skp->__sk_common.skc_daddr; u16 dport = skp->__sk_common.skc_dport; // output bpf_trace_printk("trace_tcp4connect %x %x %d\\n", saddr, daddr, ntohs(dport)); currsock.delete(&pid); return 0; } """ # initialize BPF b = BPF(text=bpf_text) # header print("%-6s %-12s %-16s %-16s %-4s" % ("PID", "COMM", "SADDR", "DADDR", "DPORT")) def inet_ntoa(addr): dq = b'' for i in range(0, 4): dq = dq + str(addr & 0xff).encode() if (i != 3): dq = dq + b'.' addr = addr >> 8 return dq # filter and format output while 1: # Read messages from kernel pipe try: (task, pid, cpu, flags, ts, msg) = b.trace_fields() (_tag, saddr_hs, daddr_hs, dport_s) = msg.split(b" ") except ValueError: # Ignore messages from other tracers continue except KeyboardInterrupt: exit() # Ignore messages from other tracers if _tag.decode() != "trace_tcp4connect": continue printb(b"%-6d %-12.12s %-16s %-16s %-4s" % (pid, task, inet_ntoa(int(saddr_hs, 16)), inet_ntoa(int(daddr_hs, 16)), dport_s))

---

docroot: /var/www/469ed2f6-4d4b-4a8a-9f5e-ee4ef04d3bc8/public_html

---

curdir: /usr/share/doc/bpfcc-tools/examples/tracing

	.		4096
	..		4096
X	CMakeLists.txt		276
X	biolatpcts.py		3312
X	biolatpcts_example.txt		650
X	bitehist.py		1397
X	bitehist_example.txt		1208
X	dddos.py		3818
X	dddos_example.txt		2112
X	disksnoop.py		1947
X	disksnoop_example.txt		1587
X	hello_fields.py		679
X	hello_perf_output.py		1270
X	hello_perf_output_using_ns.py		1843
X	kvm_hypercall.py		1520
X	kvm_hypercall.txt		1782
X	mallocstacks.py		1942
X	mysqld_query.py		1701
X	mysqld_query_example.txt		499
X	nflatency.py		6214
X	nodejs_http_server.py		1376
X	nodejs_http_server_example.txt		276
X	stack_buildid_example.py		3106
X	stacksnoop.py		3252
X	stacksnoop_example.txt		2871
X	strlen_count.py		1331
X	strlen_hist.py		1856
X	strlen_hist_ifunc.py		3800
X	strlen_snoop.py		1384
X	sync_timing.py		1390
X	task_switch.c		499
X	task_switch.py		486
X	tcpv4connect.py		2413
X	tcpv4connect_example.txt		1063
X	trace_fields.py		589
X	trace_perf_output.py		1600
X	undump.py		3602
X	undump_example.txt		886
X	urandomread-explicit.py		1511
X	urandomread.py		1032
X	urandomread_example.txt		675
X	vfsreadlat.c		896
X	vfsreadlat.py		1336
X	vfsreadlat_example.txt		3619