Alexey Ivanov | 777e802 | 2019-01-03 13:46:38 -0800 | [diff] [blame] | 1 | #!/usr/bin/env python |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 2 | # @lint-avoid-python-3-compatibility-imports |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 3 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 4 | # tcpconnect Trace TCP connect()s. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 6 | # |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 7 | # USAGE: tcpconnect [-h] [-t] [-p PID] [-P PORT [PORT ...]] |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 8 | # |
| 9 | # All connection attempts are traced, even if they ultimately fail. |
| 10 | # |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 11 | # This uses dynamic tracing of kernel functions, and will need to be updated |
| 12 | # to match kernel changes. |
| 13 | # |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 14 | # Copyright (c) 2015 Brendan Gregg. |
| 15 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 16 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 17 | # 25-Sep-2015 Brendan Gregg Created this. |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 18 | # 14-Feb-2016 " " Switch to bpf_perf_output. |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 19 | # 09-Jan-2019 Takuma Kume Support filtering by UID |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 20 | |
| 21 | from __future__ import print_function |
| 22 | from bcc import BPF |
japroc | aed9b1e | 2019-01-04 20:21:46 +0300 | [diff] [blame] | 23 | from bcc.utils import printb |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 24 | import argparse |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 25 | from socket import inet_ntop, ntohs, AF_INET, AF_INET6 |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 26 | from struct import pack |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 27 | import ctypes as ct |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 28 | |
| 29 | # arguments |
| 30 | examples = """examples: |
| 31 | ./tcpconnect # trace all TCP connect()s |
| 32 | ./tcpconnect -t # include timestamps |
| 33 | ./tcpconnect -p 181 # only trace PID 181 |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 34 | ./tcpconnect -P 80 # only trace port 80 |
| 35 | ./tcpconnect -P 80,81 # only trace port 80 and 81 |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 36 | ./tcpconnect -U # include UID |
| 37 | ./tcpconnect -u 1000 # only trace UID 1000 |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 38 | """ |
| 39 | parser = argparse.ArgumentParser( |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 40 | description="Trace TCP connects", |
| 41 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 42 | epilog=examples) |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 43 | parser.add_argument("-t", "--timestamp", action="store_true", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 44 | help="include timestamp on output") |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 45 | parser.add_argument("-p", "--pid", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 46 | help="trace this PID only") |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 47 | parser.add_argument("-P", "--port", |
| 48 | help="comma-separated list of destination ports to trace.") |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 49 | parser.add_argument("-U", "--print-uid", action="store_true", |
| 50 | help="include UID on output") |
| 51 | parser.add_argument("-u", "--uid", |
| 52 | help="trace this UID only") |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 53 | parser.add_argument("--ebpf", action="store_true", |
| 54 | help=argparse.SUPPRESS) |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 55 | args = parser.parse_args() |
| 56 | debug = 0 |
| 57 | |
| 58 | # define BPF program |
| 59 | bpf_text = """ |
| 60 | #include <uapi/linux/ptrace.h> |
| 61 | #include <net/sock.h> |
| 62 | #include <bcc/proto.h> |
| 63 | |
| 64 | BPF_HASH(currsock, u32, struct sock *); |
| 65 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 66 | // separate data structs for ipv4 and ipv6 |
| 67 | struct ipv4_data_t { |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 68 | u64 ts_us; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 69 | u32 pid; |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 70 | u32 uid; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 71 | u32 saddr; |
| 72 | u32 daddr; |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 73 | u64 ip; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 74 | u16 dport; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 75 | char task[TASK_COMM_LEN]; |
| 76 | }; |
| 77 | BPF_PERF_OUTPUT(ipv4_events); |
| 78 | |
| 79 | struct ipv6_data_t { |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 80 | u64 ts_us; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 81 | u32 pid; |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 82 | u32 uid; |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 83 | unsigned __int128 saddr; |
| 84 | unsigned __int128 daddr; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 85 | u64 ip; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 86 | u16 dport; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 87 | char task[TASK_COMM_LEN]; |
| 88 | }; |
| 89 | BPF_PERF_OUTPUT(ipv6_events); |
| 90 | |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 91 | int trace_connect_entry(struct pt_regs *ctx, struct sock *sk) |
| 92 | { |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 93 | u32 pid = bpf_get_current_pid_tgid(); |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 94 | FILTER_PID |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 95 | |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 96 | u32 uid = bpf_get_current_uid_gid(); |
| 97 | FILTER_UID |
| 98 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 99 | // stash the sock ptr for lookup on return |
| 100 | currsock.update(&pid, &sk); |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 101 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 102 | return 0; |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 103 | }; |
| 104 | |
| 105 | static int trace_connect_return(struct pt_regs *ctx, short ipver) |
| 106 | { |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 107 | int ret = PT_REGS_RC(ctx); |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 108 | u32 pid = bpf_get_current_pid_tgid(); |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 109 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 110 | struct sock **skpp; |
| 111 | skpp = currsock.lookup(&pid); |
| 112 | if (skpp == 0) { |
| 113 | return 0; // missed entry |
| 114 | } |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 115 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 116 | if (ret != 0) { |
| 117 | // failed to send SYNC packet, may not have populated |
| 118 | // socket __sk_common.{skc_rcv_saddr, ...} |
| 119 | currsock.delete(&pid); |
| 120 | return 0; |
| 121 | } |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 122 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 123 | // pull in details |
| 124 | struct sock *skp = *skpp; |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 125 | u16 dport = skp->__sk_common.skc_dport; |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 126 | |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 127 | FILTER_PORT |
| 128 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 129 | if (ipver == 4) { |
| 130 | struct ipv4_data_t data4 = {.pid = pid, .ip = ipver}; |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 131 | data4.uid = bpf_get_current_uid_gid(); |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 132 | data4.ts_us = bpf_ktime_get_ns() / 1000; |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 133 | data4.saddr = skp->__sk_common.skc_rcv_saddr; |
| 134 | data4.daddr = skp->__sk_common.skc_daddr; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 135 | data4.dport = ntohs(dport); |
| 136 | bpf_get_current_comm(&data4.task, sizeof(data4.task)); |
| 137 | ipv4_events.perf_submit(ctx, &data4, sizeof(data4)); |
| 138 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 139 | } else /* 6 */ { |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 140 | struct ipv6_data_t data6 = {.pid = pid, .ip = ipver}; |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 141 | data6.uid = bpf_get_current_uid_gid(); |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 142 | data6.ts_us = bpf_ktime_get_ns() / 1000; |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 143 | bpf_probe_read(&data6.saddr, sizeof(data6.saddr), |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 144 | skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 145 | bpf_probe_read(&data6.daddr, sizeof(data6.daddr), |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 146 | skp->__sk_common.skc_v6_daddr.in6_u.u6_addr32); |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 147 | data6.dport = ntohs(dport); |
| 148 | bpf_get_current_comm(&data6.task, sizeof(data6.task)); |
| 149 | ipv6_events.perf_submit(ctx, &data6, sizeof(data6)); |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 150 | } |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 151 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 152 | currsock.delete(&pid); |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 153 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 154 | return 0; |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 155 | } |
| 156 | |
| 157 | int trace_connect_v4_return(struct pt_regs *ctx) |
| 158 | { |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 159 | return trace_connect_return(ctx, 4); |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 160 | } |
| 161 | |
| 162 | int trace_connect_v6_return(struct pt_regs *ctx) |
| 163 | { |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 164 | return trace_connect_return(ctx, 6); |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 165 | } |
| 166 | """ |
| 167 | |
| 168 | # code substitutions |
| 169 | if args.pid: |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 170 | bpf_text = bpf_text.replace('FILTER_PID', |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 171 | 'if (pid != %s) { return 0; }' % args.pid) |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 172 | if args.port: |
| 173 | dports = [int(dport) for dport in args.port.split(',')] |
| 174 | dports_if = ' && '.join(['dport != %d' % ntohs(dport) for dport in dports]) |
| 175 | bpf_text = bpf_text.replace('FILTER_PORT', |
| 176 | 'if (%s) { currsock.delete(&pid); return 0; }' % dports_if) |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 177 | if args.uid: |
| 178 | bpf_text = bpf_text.replace('FILTER_UID', |
| 179 | 'if (uid != %s) { return 0; }' % args.uid) |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 180 | |
| 181 | bpf_text = bpf_text.replace('FILTER_PID', '') |
| 182 | bpf_text = bpf_text.replace('FILTER_PORT', '') |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 183 | bpf_text = bpf_text.replace('FILTER_UID', '') |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 184 | |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 185 | if debug or args.ebpf: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 186 | print(bpf_text) |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 187 | if args.ebpf: |
| 188 | exit() |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 189 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 190 | # event data |
| 191 | TASK_COMM_LEN = 16 # linux/sched.h |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 192 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 193 | class Data_ipv4(ct.Structure): |
| 194 | _fields_ = [ |
| 195 | ("ts_us", ct.c_ulonglong), |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 196 | ("pid", ct.c_uint), |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 197 | ("uid", ct.c_uint), |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 198 | ("saddr", ct.c_uint), |
| 199 | ("daddr", ct.c_uint), |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 200 | ("ip", ct.c_ulonglong), |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 201 | ("dport", ct.c_ushort), |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 202 | ("task", ct.c_char * TASK_COMM_LEN) |
| 203 | ] |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 204 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 205 | class Data_ipv6(ct.Structure): |
| 206 | _fields_ = [ |
| 207 | ("ts_us", ct.c_ulonglong), |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 208 | ("pid", ct.c_uint), |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 209 | ("uid", ct.c_uint), |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 210 | ("saddr", (ct.c_ulonglong * 2)), |
| 211 | ("daddr", (ct.c_ulonglong * 2)), |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 212 | ("ip", ct.c_ulonglong), |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 213 | ("dport", ct.c_ushort), |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 214 | ("task", ct.c_char * TASK_COMM_LEN) |
| 215 | ] |
| 216 | |
| 217 | # process event |
| 218 | def print_ipv4_event(cpu, data, size): |
| 219 | event = ct.cast(data, ct.POINTER(Data_ipv4)).contents |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 220 | global start_ts |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 221 | if args.timestamp: |
| 222 | if start_ts == 0: |
| 223 | start_ts = event.ts_us |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 224 | print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="") |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 225 | if args.print_uid: |
| 226 | print("%-6d" % event.uid, end="") |
japroc | aed9b1e | 2019-01-04 20:21:46 +0300 | [diff] [blame] | 227 | printb(b"%-6d %-12.12s %-2d %-16s %-16s %-4d" % (event.pid, |
Yonghong Song | ebe1951 | 2019-01-10 14:54:16 -0800 | [diff] [blame] | 228 | event.task, event.ip, |
| 229 | inet_ntop(AF_INET, pack("I", event.saddr)).encode(), |
| 230 | inet_ntop(AF_INET, pack("I", event.daddr)).encode(), event.dport)) |
Brendan Gregg | 9e0b087 | 2016-03-28 12:11:45 -0700 | [diff] [blame] | 231 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 232 | def print_ipv6_event(cpu, data, size): |
| 233 | event = ct.cast(data, ct.POINTER(Data_ipv6)).contents |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 234 | global start_ts |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 235 | if args.timestamp: |
| 236 | if start_ts == 0: |
| 237 | start_ts = event.ts_us |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 238 | print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="") |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 239 | if args.print_uid: |
| 240 | print("%-6d" % event.uid, end="") |
japroc | aed9b1e | 2019-01-04 20:21:46 +0300 | [diff] [blame] | 241 | printb(b"%-6d %-12.12s %-2d %-16s %-16s %-4d" % (event.pid, |
Yonghong Song | ebe1951 | 2019-01-10 14:54:16 -0800 | [diff] [blame] | 242 | event.task, event.ip, |
| 243 | inet_ntop(AF_INET6, event.saddr).encode(), inet_ntop(AF_INET6, event.daddr).encode(), |
jeromemarchand | b96ebcd | 2018-10-10 01:58:15 +0200 | [diff] [blame] | 244 | event.dport)) |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 245 | |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 246 | # initialize BPF |
| 247 | b = BPF(text=bpf_text) |
| 248 | b.attach_kprobe(event="tcp_v4_connect", fn_name="trace_connect_entry") |
| 249 | b.attach_kprobe(event="tcp_v6_connect", fn_name="trace_connect_entry") |
| 250 | b.attach_kretprobe(event="tcp_v4_connect", fn_name="trace_connect_v4_return") |
| 251 | b.attach_kretprobe(event="tcp_v6_connect", fn_name="trace_connect_v6_return") |
| 252 | |
| 253 | # header |
| 254 | if args.timestamp: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 255 | print("%-9s" % ("TIME(s)"), end="") |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 256 | if args.print_uid: |
| 257 | print("%-6s" % ("UID"), end="") |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 258 | print("%-6s %-12s %-2s %-16s %-16s %-4s" % ("PID", "COMM", "IP", "SADDR", |
| 259 | "DADDR", "DPORT")) |
| 260 | |
| 261 | start_ts = 0 |
| 262 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 263 | # read events |
| 264 | b["ipv4_events"].open_perf_buffer(print_ipv4_event) |
| 265 | b["ipv6_events"].open_perf_buffer(print_ipv6_event) |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 266 | while 1: |
Jerome Marchand | 5167127 | 2018-12-19 01:57:24 +0100 | [diff] [blame] | 267 | try: |
| 268 | b.perf_buffer_poll() |
| 269 | except KeyboardInterrupt: |
| 270 | exit() |