Alexey Ivanov | cc01a9c | 2019-01-16 09:50:46 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 2 | # @lint-avoid-python-3-compatibility-imports |
| 3 | # |
| 4 | # tcpdrop Trace TCP kernel-dropped packets/segments. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
| 6 | # |
| 7 | # This provides information such as packet details, socket state, and kernel |
| 8 | # stack trace for packets/segments that were dropped via tcp_drop(). |
| 9 | # |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 10 | # USAGE: tcpdrop [-4 | -6] [-h] |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 11 | # |
| 12 | # This uses dynamic tracing of kernel functions, and will need to be updated |
| 13 | # to match kernel changes. |
| 14 | # |
| 15 | # Copyright 2018 Netflix, Inc. |
| 16 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 17 | # |
| 18 | # 30-May-2018 Brendan Gregg Created this. |
| 19 | |
| 20 | from __future__ import print_function |
| 21 | from bcc import BPF |
| 22 | import argparse |
| 23 | from time import strftime |
| 24 | from socket import inet_ntop, AF_INET, AF_INET6 |
| 25 | from struct import pack |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 26 | from time import sleep |
| 27 | from bcc import tcp |
| 28 | |
| 29 | # arguments |
| 30 | examples = """examples: |
| 31 | ./tcpdrop # trace kernel TCP drops |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 32 | ./tcpdrop -4 # trace IPv4 family only |
| 33 | ./tcpdrop -6 # trace IPv6 family only |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 34 | """ |
| 35 | parser = argparse.ArgumentParser( |
| 36 | description="Trace TCP drops by the kernel", |
| 37 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 38 | epilog=examples) |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 39 | group = parser.add_mutually_exclusive_group() |
| 40 | group.add_argument("-4", "--ipv4", action="store_true", |
| 41 | help="trace IPv4 family only") |
| 42 | group.add_argument("-6", "--ipv6", action="store_true", |
| 43 | help="trace IPv6 family only") |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 44 | parser.add_argument("--ebpf", action="store_true", |
| 45 | help=argparse.SUPPRESS) |
| 46 | args = parser.parse_args() |
| 47 | debug = 0 |
| 48 | |
| 49 | # define BPF program |
| 50 | bpf_text = """ |
| 51 | #include <uapi/linux/ptrace.h> |
| 52 | #include <uapi/linux/tcp.h> |
| 53 | #include <uapi/linux/ip.h> |
| 54 | #include <net/sock.h> |
| 55 | #include <bcc/proto.h> |
| 56 | |
| 57 | BPF_STACK_TRACE(stack_traces, 1024); |
| 58 | |
| 59 | // separate data structs for ipv4 and ipv6 |
| 60 | struct ipv4_data_t { |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 61 | u32 pid; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 62 | u64 ip; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 63 | u32 saddr; |
| 64 | u32 daddr; |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 65 | u16 sport; |
| 66 | u16 dport; |
| 67 | u8 state; |
| 68 | u8 tcpflags; |
| 69 | u32 stack_id; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 70 | }; |
| 71 | BPF_PERF_OUTPUT(ipv4_events); |
| 72 | |
| 73 | struct ipv6_data_t { |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 74 | u32 pid; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 75 | u64 ip; |
| 76 | unsigned __int128 saddr; |
| 77 | unsigned __int128 daddr; |
Brendan Gregg | 1a5090a | 2018-06-08 14:21:31 -0700 | [diff] [blame] | 78 | u16 sport; |
| 79 | u16 dport; |
| 80 | u8 state; |
| 81 | u8 tcpflags; |
| 82 | u32 stack_id; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 83 | }; |
| 84 | BPF_PERF_OUTPUT(ipv6_events); |
| 85 | |
| 86 | static struct tcphdr *skb_to_tcphdr(const struct sk_buff *skb) |
| 87 | { |
| 88 | // unstable API. verify logic in tcp_hdr() -> skb_transport_header(). |
| 89 | return (struct tcphdr *)(skb->head + skb->transport_header); |
| 90 | } |
| 91 | |
| 92 | static inline struct iphdr *skb_to_iphdr(const struct sk_buff *skb) |
| 93 | { |
| 94 | // unstable API. verify logic in ip_hdr() -> skb_network_header(). |
| 95 | return (struct iphdr *)(skb->head + skb->network_header); |
| 96 | } |
| 97 | |
| 98 | // from include/net/tcp.h: |
| 99 | #ifndef tcp_flag_byte |
| 100 | #define tcp_flag_byte(th) (((u_int8_t *)th)[13]) |
| 101 | #endif |
| 102 | |
| 103 | int trace_tcp_drop(struct pt_regs *ctx, struct sock *sk, struct sk_buff *skb) |
| 104 | { |
| 105 | if (sk == NULL) |
| 106 | return 0; |
Hengqi Chen | 151fe19 | 2021-05-16 17:18:27 +0800 | [diff] [blame] | 107 | u32 pid = bpf_get_current_pid_tgid() >> 32; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 108 | |
| 109 | // pull in details from the packet headers and the sock struct |
| 110 | u16 family = sk->__sk_common.skc_family; |
| 111 | char state = sk->__sk_common.skc_state; |
| 112 | u16 sport = 0, dport = 0; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 113 | struct tcphdr *tcp = skb_to_tcphdr(skb); |
| 114 | struct iphdr *ip = skb_to_iphdr(skb); |
Paul Chaignon | 4ba5c09 | 2018-06-28 23:11:20 +0200 | [diff] [blame] | 115 | u8 tcpflags = ((u_int8_t *)tcp)[13]; |
Paul Chaignon | fe779f3 | 2018-06-14 03:51:55 +0200 | [diff] [blame] | 116 | sport = tcp->source; |
| 117 | dport = tcp->dest; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 118 | sport = ntohs(sport); |
| 119 | dport = ntohs(dport); |
| 120 | |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 121 | FILTER_FAMILY |
| 122 | |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 123 | if (family == AF_INET) { |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 124 | struct ipv4_data_t data4 = {}; |
| 125 | data4.pid = pid; |
| 126 | data4.ip = 4; |
Paul Chaignon | fe779f3 | 2018-06-14 03:51:55 +0200 | [diff] [blame] | 127 | data4.saddr = ip->saddr; |
| 128 | data4.daddr = ip->daddr; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 129 | data4.dport = dport; |
| 130 | data4.sport = sport; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 131 | data4.state = state; |
Brendan Gregg | b2b9871 | 2018-06-01 01:28:08 -0400 | [diff] [blame] | 132 | data4.tcpflags = tcpflags; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 133 | data4.stack_id = stack_traces.get_stackid(ctx, 0); |
| 134 | ipv4_events.perf_submit(ctx, &data4, sizeof(data4)); |
| 135 | |
| 136 | } else if (family == AF_INET6) { |
Marko Myllynen | bfbf17e | 2018-09-11 21:49:58 +0300 | [diff] [blame] | 137 | struct ipv6_data_t data6 = {}; |
| 138 | data6.pid = pid; |
| 139 | data6.ip = 6; |
Neil Spring | 7e3f0c0 | 2020-09-28 14:29:24 -0700 | [diff] [blame] | 140 | // The remote address (skc_v6_daddr) was the source |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 141 | bpf_probe_read_kernel(&data6.saddr, sizeof(data6.saddr), |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 142 | sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32); |
Neil Spring | 7e3f0c0 | 2020-09-28 14:29:24 -0700 | [diff] [blame] | 143 | // The local address (skc_v6_rcv_saddr) was the destination |
| 144 | bpf_probe_read_kernel(&data6.daddr, sizeof(data6.daddr), |
| 145 | sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 146 | data6.dport = dport; |
| 147 | data6.sport = sport; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 148 | data6.state = state; |
Brendan Gregg | b2b9871 | 2018-06-01 01:28:08 -0400 | [diff] [blame] | 149 | data6.tcpflags = tcpflags; |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 150 | data6.stack_id = stack_traces.get_stackid(ctx, 0); |
| 151 | ipv6_events.perf_submit(ctx, &data6, sizeof(data6)); |
| 152 | } |
| 153 | // else drop |
| 154 | |
| 155 | return 0; |
| 156 | } |
| 157 | """ |
| 158 | |
| 159 | if debug or args.ebpf: |
| 160 | print(bpf_text) |
| 161 | if args.ebpf: |
| 162 | exit() |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 163 | if args.ipv4: |
| 164 | bpf_text = bpf_text.replace('FILTER_FAMILY', |
| 165 | 'if (family != AF_INET) { return 0; }') |
| 166 | elif args.ipv6: |
| 167 | bpf_text = bpf_text.replace('FILTER_FAMILY', |
| 168 | 'if (family != AF_INET6) { return 0; }') |
| 169 | else: |
| 170 | bpf_text = bpf_text.replace('FILTER_FAMILY', '') |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 171 | |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 172 | # process event |
| 173 | def print_ipv4_event(cpu, data, size): |
Xiaozhou Liu | 51d62d3 | 2019-02-15 13:03:05 +0800 | [diff] [blame] | 174 | event = b["ipv4_events"].event(data) |
Hengqi Chen | 151fe19 | 2021-05-16 17:18:27 +0800 | [diff] [blame] | 175 | print("%-8s %-7d %-2d %-20s > %-20s %s (%s)" % ( |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 176 | strftime("%H:%M:%S"), event.pid, event.ip, |
| 177 | "%s:%d" % (inet_ntop(AF_INET, pack('I', event.saddr)), event.sport), |
| 178 | "%s:%s" % (inet_ntop(AF_INET, pack('I', event.daddr)), event.dport), |
| 179 | tcp.tcpstate[event.state], tcp.flags2str(event.tcpflags))) |
| 180 | for addr in stack_traces.walk(event.stack_id): |
| 181 | sym = b.ksym(addr, show_offset=True) |
| 182 | print("\t%s" % sym) |
| 183 | print("") |
| 184 | |
| 185 | def print_ipv6_event(cpu, data, size): |
Xiaozhou Liu | 51d62d3 | 2019-02-15 13:03:05 +0800 | [diff] [blame] | 186 | event = b["ipv6_events"].event(data) |
Hengqi Chen | 151fe19 | 2021-05-16 17:18:27 +0800 | [diff] [blame] | 187 | print("%-8s %-7d %-2d %-20s > %-20s %s (%s)" % ( |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 188 | strftime("%H:%M:%S"), event.pid, event.ip, |
| 189 | "%s:%d" % (inet_ntop(AF_INET6, event.saddr), event.sport), |
| 190 | "%s:%d" % (inet_ntop(AF_INET6, event.daddr), event.dport), |
| 191 | tcp.tcpstate[event.state], tcp.flags2str(event.tcpflags))) |
| 192 | for addr in stack_traces.walk(event.stack_id): |
| 193 | sym = b.ksym(addr, show_offset=True) |
| 194 | print("\t%s" % sym) |
| 195 | print("") |
| 196 | |
| 197 | # initialize BPF |
| 198 | b = BPF(text=bpf_text) |
yonghong-song | 3b86b56 | 2018-06-13 06:12:43 -0700 | [diff] [blame] | 199 | if b.get_kprobe_functions(b"tcp_drop"): |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 200 | b.attach_kprobe(event="tcp_drop", fn_name="trace_tcp_drop") |
| 201 | else: |
| 202 | print("ERROR: tcp_drop() kernel function not found or traceable. " |
| 203 | "Older kernel versions not supported.") |
| 204 | exit() |
| 205 | stack_traces = b.get_table("stack_traces") |
| 206 | |
| 207 | # header |
Hengqi Chen | 151fe19 | 2021-05-16 17:18:27 +0800 | [diff] [blame] | 208 | print("%-8s %-7s %-2s %-20s > %-20s %s (%s)" % ("TIME", "PID", "IP", |
Brendan Gregg | 4f13d88 | 2018-05-30 17:09:04 -0400 | [diff] [blame] | 209 | "SADDR:SPORT", "DADDR:DPORT", "STATE", "FLAGS")) |
| 210 | |
| 211 | # read events |
| 212 | b["ipv4_events"].open_perf_buffer(print_ipv4_event) |
| 213 | b["ipv6_events"].open_perf_buffer(print_ipv6_event) |
| 214 | while 1: |
Jerome Marchand | 5167127 | 2018-12-19 01:57:24 +0100 | [diff] [blame] | 215 | try: |
| 216 | b.perf_buffer_poll() |
| 217 | except KeyboardInterrupt: |
| 218 | exit() |