Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 1 | Demonstrations of tcpaccept, the Linux eBPF/bcc version. |
| 2 | |
| 3 | |
| 4 | This tool traces the kernel function accepting TCP socket connections (eg, a |
| 5 | passive connection via accept(); not connect()). Some example output (IP |
| 6 | addresses changed to protect the innocent): |
| 7 | |
| 8 | # ./tcpaccept |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 9 | PID COMM IP RADDR RPORT LADDR LPORT |
| 10 | 907 sshd 4 192.168.56.1 32324 192.168.56.102 22 |
| 11 | 907 sshd 4 127.0.0.1 39866 127.0.0.1 22 |
| 12 | 5389 perl 6 1234:ab12:2040:5020:2299:0:5:0 52352 1234:ab12:2040:5020:2299:0:5:0 7001 |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 13 | |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 14 | This output shows three connections, two IPv4 connections to PID 907, an "sshd" |
| 15 | process listening on port 22, and one IPv6 connection to a "perl" process |
| 16 | listening on port 7001. |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 17 | |
| 18 | The overhead of this tool should be negligible, since it is only tracing the |
| 19 | kernel function performing accept. It is not tracing every packet and then |
| 20 | filtering. |
| 21 | |
| 22 | This tool only traces successful TCP accept()s. Connection attempts to closed |
| 23 | ports will not be shown (those can be traced via other functions). |
| 24 | |
| 25 | |
| 26 | The -t option prints a timestamp column: |
| 27 | |
| 28 | # ./tcpaccept -t |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 29 | TIME(s) PID COMM IP RADDR RPORT LADDR LPORT |
| 30 | 0.000 907 sshd 4 127.0.0.1 53700 127.0.0.1 22 |
| 31 | 0.010 5389 perl 6 1234:ab12:2040:5020:2299:0:5:0 40614 1234:ab12:2040:5020:2299:0:5:0 7001 |
| 32 | 0.992 907 sshd 4 127.0.0.1 32548 127.0.0.1 22 |
| 33 | 1.984 907 sshd 4 127.0.0.1 51250 127.0.0.1 22 |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 34 | |
| 35 | |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 36 | The --cgroupmap option filters based on a cgroup set. It is meant to be used |
| 37 | with an externally created map. |
| 38 | |
| 39 | # ./tcpaccept --cgroupmap /sys/fs/bpf/test01 |
| 40 | |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 41 | For more details, see docs/special_filtering.md |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 42 | |
| 43 | |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 44 | USAGE message: |
| 45 | |
| 46 | # ./tcpaccept -h |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 47 | usage: tcpaccept.py [-h] [-T] [-t] [-p PID] [-P PORT] [-4 | -6] [--cgroupmap CGROUPMAP] |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 48 | |
| 49 | Trace TCP accepts |
| 50 | |
| 51 | optional arguments: |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 52 | -h, --help show this help message and exit |
| 53 | -T, --time include time column on output (HH:MM:SS) |
| 54 | -t, --timestamp include timestamp on output |
| 55 | -p PID, --pid PID trace this PID only |
| 56 | -P PORT, --port PORT comma-separated list of local ports to trace |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 57 | -4, --ipv4 trace IPv4 family only |
| 58 | -6, --ipv6 trace IPv6 family only |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 59 | --cgroupmap CGROUPMAP |
| 60 | trace cgroups in this BPF map only |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 61 | |
| 62 | examples: |
Brendan Gregg | 000a4e6 | 2015-10-13 15:41:46 -0700 | [diff] [blame] | 63 | ./tcpaccept # trace all TCP accept()s |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 64 | ./tcpaccept -t # include timestamps |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 65 | ./tcpaccept -P 80,81 # only trace port 80 and 81 |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 66 | ./tcpaccept -p 181 # only trace PID 181 |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 67 | ./tcpaccept --cgroupmap mappath # only trace cgroups in this BPF map |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 68 | ./tcpaccept --mntnsmap mappath # only trace mount namespaces in the map |
| 69 | ./tcpaccept -4 # trace IPv4 family only |
| 70 | ./tcpaccept -6 # trace IPv6 family only |