Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 1 | #!/usr/bin/python |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 2 | # @lint-avoid-python-3-compatibility-imports |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 3 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 4 | # tcpaccept Trace TCP accept()s. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 6 | # |
| 7 | # USAGE: tcpaccept [-h] [-t] [-p PID] |
| 8 | # |
| 9 | # This uses dynamic tracing of the kernel inet_csk_accept() socket function |
| 10 | # (from tcp_prot.accept), and will need to be modified to match kernel changes. |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 11 | # |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 12 | # Copyright (c) 2015 Brendan Gregg. |
| 13 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 14 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 15 | # 13-Oct-2015 Brendan Gregg Created this. |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 16 | # 14-Feb-2016 " " Switch to bpf_perf_output. |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 17 | |
| 18 | from __future__ import print_function |
| 19 | from bcc import BPF |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 20 | from socket import inet_ntop, AF_INET, AF_INET6 |
| 21 | from struct import pack |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 22 | import argparse |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 23 | import ctypes as ct |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 24 | |
| 25 | # arguments |
| 26 | examples = """examples: |
Brendan Gregg | 000a4e6 | 2015-10-13 15:41:46 -0700 | [diff] [blame] | 27 | ./tcpaccept # trace all TCP accept()s |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 28 | ./tcpaccept -t # include timestamps |
| 29 | ./tcpaccept -p 181 # only trace PID 181 |
| 30 | """ |
| 31 | parser = argparse.ArgumentParser( |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 32 | description="Trace TCP accepts", |
| 33 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 34 | epilog=examples) |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 35 | parser.add_argument("-t", "--timestamp", action="store_true", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 36 | help="include timestamp on output") |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 37 | parser.add_argument("-p", "--pid", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 38 | help="trace this PID only") |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 39 | parser.add_argument("--ebpf", action="store_true", |
| 40 | help=argparse.SUPPRESS) |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 41 | args = parser.parse_args() |
| 42 | debug = 0 |
| 43 | |
| 44 | # define BPF program |
| 45 | bpf_text = """ |
| 46 | #include <uapi/linux/ptrace.h> |
| 47 | #include <net/sock.h> |
| 48 | #include <bcc/proto.h> |
| 49 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 50 | // separate data structs for ipv4 and ipv6 |
| 51 | struct ipv4_data_t { |
| 52 | // XXX: switch some to u32's when supported |
| 53 | u64 ts_us; |
| 54 | u64 pid; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 55 | u64 saddr; |
| 56 | u64 daddr; |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 57 | u64 ip; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 58 | u64 lport; |
| 59 | char task[TASK_COMM_LEN]; |
| 60 | }; |
| 61 | BPF_PERF_OUTPUT(ipv4_events); |
| 62 | |
| 63 | struct ipv6_data_t { |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 64 | u64 ts_us; |
| 65 | u64 pid; |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 66 | unsigned __int128 saddr; |
| 67 | unsigned __int128 daddr; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 68 | u64 ip; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 69 | u64 lport; |
| 70 | char task[TASK_COMM_LEN]; |
| 71 | }; |
| 72 | BPF_PERF_OUTPUT(ipv6_events); |
| 73 | |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 74 | int kretprobe__inet_csk_accept(struct pt_regs *ctx) |
| 75 | { |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 76 | struct sock *newsk = (struct sock *)PT_REGS_RC(ctx); |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 77 | u32 pid = bpf_get_current_pid_tgid(); |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 78 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 79 | if (newsk == NULL) |
| 80 | return 0; |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 81 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 82 | // check this is TCP |
| 83 | u8 protocol = 0; |
| 84 | // workaround for reading the sk_protocol bitfield: |
| 85 | bpf_probe_read(&protocol, 1, (void *)((long)&newsk->sk_wmem_queued) - 3); |
| 86 | if (protocol != IPPROTO_TCP) |
| 87 | return 0; |
Brendan Gregg | 10e1b14 | 2015-10-13 16:35:25 -0700 | [diff] [blame] | 88 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 89 | // pull in details |
| 90 | u16 family = 0, lport = 0; |
Paul Chaignon | a9f96c0 | 2018-06-15 00:27:08 +0200 | [diff] [blame] | 91 | family = newsk->__sk_common.skc_family; |
| 92 | lport = newsk->__sk_common.skc_num; |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 93 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 94 | if (family == AF_INET) { |
| 95 | struct ipv4_data_t data4 = {.pid = pid, .ip = 4}; |
| 96 | data4.ts_us = bpf_ktime_get_ns() / 1000; |
Paul Chaignon | a9f96c0 | 2018-06-15 00:27:08 +0200 | [diff] [blame] | 97 | data4.saddr = newsk->__sk_common.skc_rcv_saddr; |
| 98 | data4.daddr = newsk->__sk_common.skc_daddr; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 99 | data4.lport = lport; |
| 100 | bpf_get_current_comm(&data4.task, sizeof(data4.task)); |
| 101 | ipv4_events.perf_submit(ctx, &data4, sizeof(data4)); |
| 102 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 103 | } else if (family == AF_INET6) { |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 104 | struct ipv6_data_t data6 = {.pid = pid, .ip = 6}; |
| 105 | data6.ts_us = bpf_ktime_get_ns() / 1000; |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 106 | bpf_probe_read(&data6.saddr, sizeof(data6.saddr), |
| 107 | &newsk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); |
| 108 | bpf_probe_read(&data6.daddr, sizeof(data6.daddr), |
| 109 | &newsk->__sk_common.skc_v6_daddr.in6_u.u6_addr32); |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 110 | data6.lport = lport; |
| 111 | bpf_get_current_comm(&data6.task, sizeof(data6.task)); |
| 112 | ipv6_events.perf_submit(ctx, &data6, sizeof(data6)); |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 113 | } |
| 114 | // else drop |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 115 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 116 | return 0; |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 117 | } |
| 118 | """ |
| 119 | |
| 120 | # code substitutions |
| 121 | if args.pid: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 122 | bpf_text = bpf_text.replace('FILTER', |
| 123 | 'if (pid != %s) { return 0; }' % args.pid) |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 124 | else: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 125 | bpf_text = bpf_text.replace('FILTER', '') |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 126 | if debug or args.ebpf: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 127 | print(bpf_text) |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 128 | if args.ebpf: |
| 129 | exit() |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 130 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 131 | # event data |
| 132 | TASK_COMM_LEN = 16 # linux/sched.h |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 133 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 134 | class Data_ipv4(ct.Structure): |
| 135 | _fields_ = [ |
| 136 | ("ts_us", ct.c_ulonglong), |
| 137 | ("pid", ct.c_ulonglong), |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 138 | ("saddr", ct.c_ulonglong), |
| 139 | ("daddr", ct.c_ulonglong), |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 140 | ("ip", ct.c_ulonglong), |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 141 | ("lport", ct.c_ulonglong), |
| 142 | ("task", ct.c_char * TASK_COMM_LEN) |
| 143 | ] |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 144 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 145 | class Data_ipv6(ct.Structure): |
| 146 | _fields_ = [ |
| 147 | ("ts_us", ct.c_ulonglong), |
| 148 | ("pid", ct.c_ulonglong), |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 149 | ("saddr", (ct.c_ulonglong * 2)), |
| 150 | ("daddr", (ct.c_ulonglong * 2)), |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 151 | ("ip", ct.c_ulonglong), |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 152 | ("lport", ct.c_ulonglong), |
| 153 | ("task", ct.c_char * TASK_COMM_LEN) |
| 154 | ] |
| 155 | |
| 156 | # process event |
| 157 | def print_ipv4_event(cpu, data, size): |
| 158 | event = ct.cast(data, ct.POINTER(Data_ipv4)).contents |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 159 | global start_ts |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 160 | if args.timestamp: |
| 161 | if start_ts == 0: |
| 162 | start_ts = event.ts_us |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 163 | print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="") |
Rafael F | 78948e4 | 2017-03-26 14:54:25 +0200 | [diff] [blame] | 164 | print("%-6d %-12.12s %-2d %-16s %-16s %-4d" % (event.pid, |
| 165 | event.task.decode(), event.ip, |
| 166 | inet_ntop(AF_INET, pack("I", event.daddr)), |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 167 | inet_ntop(AF_INET, pack("I", event.saddr)), event.lport)) |
| 168 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 169 | def print_ipv6_event(cpu, data, size): |
| 170 | event = ct.cast(data, ct.POINTER(Data_ipv6)).contents |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 171 | global start_ts |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 172 | if args.timestamp: |
| 173 | if start_ts == 0: |
| 174 | start_ts = event.ts_us |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 175 | print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="") |
Rafael F | 78948e4 | 2017-03-26 14:54:25 +0200 | [diff] [blame] | 176 | print("%-6d %-12.12s %-2d %-16s %-16s %-4d" % (event.pid, |
| 177 | event.task.decode(), event.ip, inet_ntop(AF_INET6, event.daddr), |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 178 | inet_ntop(AF_INET6, event.saddr), event.lport)) |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 179 | |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 180 | # initialize BPF |
| 181 | b = BPF(text=bpf_text) |
| 182 | |
| 183 | # header |
| 184 | if args.timestamp: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 185 | print("%-9s" % ("TIME(s)"), end="") |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 186 | print("%-6s %-12s %-2s %-16s %-16s %-4s" % ("PID", "COMM", "IP", "RADDR", |
| 187 | "LADDR", "LPORT")) |
| 188 | |
| 189 | start_ts = 0 |
| 190 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 191 | # read events |
| 192 | b["ipv4_events"].open_perf_buffer(print_ipv4_event) |
| 193 | b["ipv6_events"].open_perf_buffer(print_ipv6_event) |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 194 | while 1: |
Teng Qin | dbf0029 | 2018-02-28 21:47:50 -0800 | [diff] [blame] | 195 | b.perf_buffer_poll() |