blob: 8593837721d5dc6ab3b77ae336b255a83c967803 [file] [log] [blame]
Brendan Gregg052f89c2015-10-13 15:35:58 -07001#!/usr/bin/python
Alexei Starovoitovbdf07732016-01-14 10:09:20 -08002# @lint-avoid-python-3-compatibility-imports
Brendan Gregg052f89c2015-10-13 15:35:58 -07003#
Alexei Starovoitovbdf07732016-01-14 10:09:20 -08004# tcpaccept Trace TCP accept()s.
5# For Linux, uses BCC, eBPF. Embedded C.
Brendan Gregg052f89c2015-10-13 15:35:58 -07006#
7# USAGE: tcpaccept [-h] [-t] [-p PID]
8#
9# This uses dynamic tracing of the kernel inet_csk_accept() socket function
10# (from tcp_prot.accept), and will need to be modified to match kernel changes.
Brendan Gregg052f89c2015-10-13 15:35:58 -070011#
Brendan Gregg052f89c2015-10-13 15:35:58 -070012# Copyright (c) 2015 Brendan Gregg.
13# Licensed under the Apache License, Version 2.0 (the "License")
14#
Alexei Starovoitovbdf07732016-01-14 10:09:20 -080015# 13-Oct-2015 Brendan Gregg Created this.
Brendan Gregg24825522016-02-14 16:32:29 -080016# 14-Feb-2016 " " Switch to bpf_perf_output.
Brendan Gregg052f89c2015-10-13 15:35:58 -070017
18from __future__ import print_function
19from bcc import BPF
Mark Drayton11de2982016-06-26 21:14:44 +010020from socket import inet_ntop, AF_INET, AF_INET6
21from struct import pack
Brendan Gregg052f89c2015-10-13 15:35:58 -070022import argparse
Brendan Gregg24825522016-02-14 16:32:29 -080023import ctypes as ct
Brendan Gregg052f89c2015-10-13 15:35:58 -070024
25# arguments
26examples = """examples:
Brendan Gregg000a4e62015-10-13 15:41:46 -070027 ./tcpaccept # trace all TCP accept()s
Brendan Gregg052f89c2015-10-13 15:35:58 -070028 ./tcpaccept -t # include timestamps
29 ./tcpaccept -p 181 # only trace PID 181
30"""
31parser = argparse.ArgumentParser(
Alexei Starovoitovbdf07732016-01-14 10:09:20 -080032 description="Trace TCP accepts",
33 formatter_class=argparse.RawDescriptionHelpFormatter,
34 epilog=examples)
Brendan Gregg052f89c2015-10-13 15:35:58 -070035parser.add_argument("-t", "--timestamp", action="store_true",
Alexei Starovoitovbdf07732016-01-14 10:09:20 -080036 help="include timestamp on output")
Brendan Gregg052f89c2015-10-13 15:35:58 -070037parser.add_argument("-p", "--pid",
Alexei Starovoitovbdf07732016-01-14 10:09:20 -080038 help="trace this PID only")
Brendan Gregg052f89c2015-10-13 15:35:58 -070039args = parser.parse_args()
40debug = 0
41
42# define BPF program
43bpf_text = """
44#include <uapi/linux/ptrace.h>
45#include <net/sock.h>
46#include <bcc/proto.h>
47
Brendan Gregg24825522016-02-14 16:32:29 -080048// separate data structs for ipv4 and ipv6
49struct ipv4_data_t {
50 // XXX: switch some to u32's when supported
51 u64 ts_us;
52 u64 pid;
Brendan Gregg24825522016-02-14 16:32:29 -080053 u64 saddr;
54 u64 daddr;
Mark Drayton11de2982016-06-26 21:14:44 +010055 u64 ip;
Brendan Gregg24825522016-02-14 16:32:29 -080056 u64 lport;
57 char task[TASK_COMM_LEN];
58};
59BPF_PERF_OUTPUT(ipv4_events);
60
61struct ipv6_data_t {
Brendan Gregg24825522016-02-14 16:32:29 -080062 u64 ts_us;
63 u64 pid;
Mark Drayton11de2982016-06-26 21:14:44 +010064 unsigned __int128 saddr;
65 unsigned __int128 daddr;
Brendan Gregg24825522016-02-14 16:32:29 -080066 u64 ip;
Brendan Gregg24825522016-02-14 16:32:29 -080067 u64 lport;
68 char task[TASK_COMM_LEN];
69};
70BPF_PERF_OUTPUT(ipv6_events);
71
Brendan Gregg052f89c2015-10-13 15:35:58 -070072int kretprobe__inet_csk_accept(struct pt_regs *ctx)
73{
Naveen N. Rao4afa96a2016-05-03 14:54:21 +053074 struct sock *newsk = (struct sock *)PT_REGS_RC(ctx);
Alexei Starovoitovbdf07732016-01-14 10:09:20 -080075 u32 pid = bpf_get_current_pid_tgid();
Brendan Gregg052f89c2015-10-13 15:35:58 -070076
Alexei Starovoitovbdf07732016-01-14 10:09:20 -080077 if (newsk == NULL)
78 return 0;
Brendan Gregg052f89c2015-10-13 15:35:58 -070079
Alexei Starovoitovbdf07732016-01-14 10:09:20 -080080 // check this is TCP
81 u8 protocol = 0;
82 // workaround for reading the sk_protocol bitfield:
83 bpf_probe_read(&protocol, 1, (void *)((long)&newsk->sk_wmem_queued) - 3);
84 if (protocol != IPPROTO_TCP)
85 return 0;
Brendan Gregg10e1b142015-10-13 16:35:25 -070086
Alexei Starovoitovbdf07732016-01-14 10:09:20 -080087 // pull in details
88 u16 family = 0, lport = 0;
Alexei Starovoitovbdf07732016-01-14 10:09:20 -080089 bpf_probe_read(&family, sizeof(family), &newsk->__sk_common.skc_family);
90 bpf_probe_read(&lport, sizeof(lport), &newsk->__sk_common.skc_num);
Brendan Gregg052f89c2015-10-13 15:35:58 -070091
Brendan Gregg24825522016-02-14 16:32:29 -080092 if (family == AF_INET) {
93 struct ipv4_data_t data4 = {.pid = pid, .ip = 4};
94 data4.ts_us = bpf_ktime_get_ns() / 1000;
95 bpf_probe_read(&data4.saddr, sizeof(u32),
96 &newsk->__sk_common.skc_rcv_saddr);
97 bpf_probe_read(&data4.daddr, sizeof(u32),
98 &newsk->__sk_common.skc_daddr);
99 data4.lport = lport;
100 bpf_get_current_comm(&data4.task, sizeof(data4.task));
101 ipv4_events.perf_submit(ctx, &data4, sizeof(data4));
102
Alexei Starovoitovbdf07732016-01-14 10:09:20 -0800103 } else if (family == AF_INET6) {
Brendan Gregg24825522016-02-14 16:32:29 -0800104 struct ipv6_data_t data6 = {.pid = pid, .ip = 6};
105 data6.ts_us = bpf_ktime_get_ns() / 1000;
Mark Drayton11de2982016-06-26 21:14:44 +0100106 bpf_probe_read(&data6.saddr, sizeof(data6.saddr),
107 &newsk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
108 bpf_probe_read(&data6.daddr, sizeof(data6.daddr),
109 &newsk->__sk_common.skc_v6_daddr.in6_u.u6_addr32);
Brendan Gregg24825522016-02-14 16:32:29 -0800110 data6.lport = lport;
111 bpf_get_current_comm(&data6.task, sizeof(data6.task));
112 ipv6_events.perf_submit(ctx, &data6, sizeof(data6));
Alexei Starovoitovbdf07732016-01-14 10:09:20 -0800113 }
114 // else drop
Brendan Gregg052f89c2015-10-13 15:35:58 -0700115
Alexei Starovoitovbdf07732016-01-14 10:09:20 -0800116 return 0;
Brendan Gregg052f89c2015-10-13 15:35:58 -0700117}
118"""
119
120# code substitutions
121if args.pid:
Alexei Starovoitovbdf07732016-01-14 10:09:20 -0800122 bpf_text = bpf_text.replace('FILTER',
123 'if (pid != %s) { return 0; }' % args.pid)
Brendan Gregg052f89c2015-10-13 15:35:58 -0700124else:
Alexei Starovoitovbdf07732016-01-14 10:09:20 -0800125 bpf_text = bpf_text.replace('FILTER', '')
Brendan Gregg052f89c2015-10-13 15:35:58 -0700126if debug:
Alexei Starovoitovbdf07732016-01-14 10:09:20 -0800127 print(bpf_text)
Brendan Gregg052f89c2015-10-13 15:35:58 -0700128
Brendan Gregg24825522016-02-14 16:32:29 -0800129# event data
130TASK_COMM_LEN = 16 # linux/sched.h
Mark Drayton11de2982016-06-26 21:14:44 +0100131
Brendan Gregg24825522016-02-14 16:32:29 -0800132class Data_ipv4(ct.Structure):
133 _fields_ = [
134 ("ts_us", ct.c_ulonglong),
135 ("pid", ct.c_ulonglong),
Brendan Gregg24825522016-02-14 16:32:29 -0800136 ("saddr", ct.c_ulonglong),
137 ("daddr", ct.c_ulonglong),
Mark Drayton11de2982016-06-26 21:14:44 +0100138 ("ip", ct.c_ulonglong),
Brendan Gregg24825522016-02-14 16:32:29 -0800139 ("lport", ct.c_ulonglong),
140 ("task", ct.c_char * TASK_COMM_LEN)
141 ]
Mark Drayton11de2982016-06-26 21:14:44 +0100142
Brendan Gregg24825522016-02-14 16:32:29 -0800143class Data_ipv6(ct.Structure):
144 _fields_ = [
145 ("ts_us", ct.c_ulonglong),
146 ("pid", ct.c_ulonglong),
Mark Drayton11de2982016-06-26 21:14:44 +0100147 ("saddr", (ct.c_ulonglong * 2)),
148 ("daddr", (ct.c_ulonglong * 2)),
Brendan Gregg24825522016-02-14 16:32:29 -0800149 ("ip", ct.c_ulonglong),
Brendan Gregg24825522016-02-14 16:32:29 -0800150 ("lport", ct.c_ulonglong),
151 ("task", ct.c_char * TASK_COMM_LEN)
152 ]
153
154# process event
155def print_ipv4_event(cpu, data, size):
156 event = ct.cast(data, ct.POINTER(Data_ipv4)).contents
Mark Drayton11de2982016-06-26 21:14:44 +0100157 global start_ts
Brendan Gregg24825522016-02-14 16:32:29 -0800158 if args.timestamp:
159 if start_ts == 0:
160 start_ts = event.ts_us
Mark Drayton11de2982016-06-26 21:14:44 +0100161 print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="")
Rafael F78948e42017-03-26 14:54:25 +0200162 print("%-6d %-12.12s %-2d %-16s %-16s %-4d" % (event.pid,
163 event.task.decode(), event.ip,
164 inet_ntop(AF_INET, pack("I", event.daddr)),
Mark Drayton11de2982016-06-26 21:14:44 +0100165 inet_ntop(AF_INET, pack("I", event.saddr)), event.lport))
166
Brendan Gregg24825522016-02-14 16:32:29 -0800167def print_ipv6_event(cpu, data, size):
168 event = ct.cast(data, ct.POINTER(Data_ipv6)).contents
Mark Drayton11de2982016-06-26 21:14:44 +0100169 global start_ts
Brendan Gregg24825522016-02-14 16:32:29 -0800170 if args.timestamp:
171 if start_ts == 0:
172 start_ts = event.ts_us
Mark Drayton11de2982016-06-26 21:14:44 +0100173 print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="")
Rafael F78948e42017-03-26 14:54:25 +0200174 print("%-6d %-12.12s %-2d %-16s %-16s %-4d" % (event.pid,
175 event.task.decode(), event.ip, inet_ntop(AF_INET6, event.daddr),
Mark Drayton11de2982016-06-26 21:14:44 +0100176 inet_ntop(AF_INET6, event.saddr), event.lport))
Brendan Gregg24825522016-02-14 16:32:29 -0800177
Brendan Gregg052f89c2015-10-13 15:35:58 -0700178# initialize BPF
179b = BPF(text=bpf_text)
180
181# header
182if args.timestamp:
Alexei Starovoitovbdf07732016-01-14 10:09:20 -0800183 print("%-9s" % ("TIME(s)"), end="")
Brendan Gregg052f89c2015-10-13 15:35:58 -0700184print("%-6s %-12s %-2s %-16s %-16s %-4s" % ("PID", "COMM", "IP", "RADDR",
185 "LADDR", "LPORT"))
186
187start_ts = 0
188
Brendan Gregg24825522016-02-14 16:32:29 -0800189# read events
190b["ipv4_events"].open_perf_buffer(print_ipv4_event)
191b["ipv6_events"].open_perf_buffer(print_ipv6_event)
Brendan Gregg052f89c2015-10-13 15:35:58 -0700192while 1:
Brendan Gregg24825522016-02-14 16:32:29 -0800193 b.kprobe_poll()