| Brenden Blanco | 5bd0eb2 | 2016-01-26 12:04:06 -0800 | [diff] [blame] | 1 | Demonstrations of tcpv4connect.py, the Linux eBPF/bcc version. |
| Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 2 | |
| 3 | |
| 4 | This example traces the kernel function performing active TCP IPv4 connections |
| 5 | (eg, via a connect() syscall; accept() are passive connections). Some example |
| 6 | output (IP addresses changed to protect the innocent): |
| 7 | |
| Brenden Blanco | 5bd0eb2 | 2016-01-26 12:04:06 -0800 | [diff] [blame] | 8 | # ./tcpv4connect.py |
| Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 9 | PID COMM SADDR DADDR DPORT |
| 10 | 1479 telnet 127.0.0.1 127.0.0.1 23 |
| 11 | 1469 curl 10.201.219.236 54.245.105.25 80 |
| 12 | 1469 curl 10.201.219.236 54.67.101.145 80 |
| 13 | |
| 14 | This output shows three connections, one from a "telnet" process and two from |
| 15 | "curl". The output details shows the source address, destination address, |
| 16 | and destination port. This traces attempted connections: these may have failed. |
| 17 | |
| 18 | The overhead of this tool should be negligible, since it is only tracing the |
| 19 | kernel function performing a connect. It is not tracing every packet and then |
| 20 | filtering. |
| 21 | |
| 22 | This is provided as a basic example of TCP tracing. See tools/tcpconnect for a |
| 23 | more featured version of this example (a tool). |