Added IPv4/IPv6 filter support for tcp trace tools (#3565)
* Added IPv4/IPv6 filter support for tcp trace tools
* Fixed a typo
* Added usage for TCP syn backlog
* Fixed a typo
* Fixed a typo
* Added man support for IPv4/IPv6 family filters
diff --git a/tools/tcpaccept.py b/tools/tcpaccept.py
index 1a5f1c7..d3e4414 100755
--- a/tools/tcpaccept.py
+++ b/tools/tcpaccept.py
@@ -4,7 +4,7 @@
# tcpaccept Trace TCP accept()s.
# For Linux, uses BCC, eBPF. Embedded C.
#
-# USAGE: tcpaccept [-h] [-T] [-t] [-p PID] [-P PORTS]
+# USAGE: tcpaccept [-h] [-T] [-t] [-p PID] [-P PORTS] [-4 | -6]
#
# This uses dynamic tracing of the kernel inet_csk_accept() socket function
# (from tcp_prot.accept), and will need to be modified to match kernel changes.
@@ -32,6 +32,8 @@
./tcpaccept -p 181 # only trace PID 181
./tcpaccept --cgroupmap mappath # only trace cgroups in this BPF map
./tcpaccept --mntnsmap mappath # only trace mount namespaces in the map
+ ./tcpaccept -4 # trace IPv4 family
+ ./tcpaccept -6 # trace IPv6 family
"""
parser = argparse.ArgumentParser(
description="Trace TCP accepts",
@@ -45,6 +47,11 @@
help="trace this PID only")
parser.add_argument("-P", "--port",
help="comma-separated list of local ports to trace")
+group = parser.add_mutually_exclusive_group()
+group.add_argument("-4", "--ipv4", action="store_true",
+ help="trace IPv4 family only")
+group.add_argument("-6", "--ipv6", action="store_true",
+ help="trace IPv6 family only")
parser.add_argument("--cgroupmap",
help="trace cgroups in this BPF map only")
parser.add_argument("--mntnsmap",
@@ -152,6 +159,8 @@
dport = newsk->__sk_common.skc_dport;
dport = ntohs(dport);
+ ##FILTER_FAMILY##
+
##FILTER_PORT##
if (family == AF_INET) {
@@ -195,6 +204,13 @@
lports_if = ' && '.join(['lport != %d' % lport for lport in lports])
bpf_text = bpf_text.replace('##FILTER_PORT##',
'if (%s) { return 0; }' % lports_if)
+if args.ipv4:
+ bpf_text = bpf_text.replace('##FILTER_FAMILY##',
+ 'if (family != AF_INET) { return 0; }')
+elif args.ipv6:
+ bpf_text = bpf_text.replace('##FILTER_FAMILY##',
+ 'if (family != AF_INET6) { return 0; }')
+
bpf_text = filter_by_containers(args) + bpf_text
if debug or args.ebpf:
print(bpf_text)
@@ -202,6 +218,7 @@
exit()
bpf_text = bpf_text.replace('##FILTER_PORT##', '')
+bpf_text = bpf_text.replace('##FILTER_FAMILY##', '')
# process event
def print_ipv4_event(cpu, data, size):