Alexey Ivanov | cc01a9c | 2019-01-16 09:50:46 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 2 | # @lint-avoid-python-3-compatibility-imports |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 3 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 4 | # tcpaccept Trace TCP accept()s. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 6 | # |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 7 | # USAGE: tcpaccept [-h] [-T] [-t] [-p PID] [-P PORTS] [-4 | -6] |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 8 | # |
| 9 | # This uses dynamic tracing of the kernel inet_csk_accept() socket function |
| 10 | # (from tcp_prot.accept), and will need to be modified to match kernel changes. |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 11 | # |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 12 | # Copyright (c) 2015 Brendan Gregg. |
| 13 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 14 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 15 | # 13-Oct-2015 Brendan Gregg Created this. |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 16 | # 14-Feb-2016 " " Switch to bpf_perf_output. |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 17 | |
| 18 | from __future__ import print_function |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 19 | from bcc.containers import filter_by_containers |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 20 | from bcc import BPF |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 21 | from socket import inet_ntop, AF_INET, AF_INET6 |
| 22 | from struct import pack |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 23 | import argparse |
japroc | aed9b1e | 2019-01-04 20:21:46 +0300 | [diff] [blame] | 24 | from bcc.utils import printb |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 25 | from time import strftime |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 26 | |
| 27 | # arguments |
| 28 | examples = """examples: |
Brendan Gregg | 000a4e6 | 2015-10-13 15:41:46 -0700 | [diff] [blame] | 29 | ./tcpaccept # trace all TCP accept()s |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 30 | ./tcpaccept -t # include timestamps |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 31 | ./tcpaccept -P 80,81 # only trace port 80 and 81 |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 32 | ./tcpaccept -p 181 # only trace PID 181 |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 33 | ./tcpaccept --cgroupmap mappath # only trace cgroups in this BPF map |
| 34 | ./tcpaccept --mntnsmap mappath # only trace mount namespaces in the map |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 35 | ./tcpaccept -4 # trace IPv4 family |
| 36 | ./tcpaccept -6 # trace IPv6 family |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 37 | """ |
| 38 | parser = argparse.ArgumentParser( |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 39 | description="Trace TCP accepts", |
| 40 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 41 | epilog=examples) |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 42 | parser.add_argument("-T", "--time", action="store_true", |
| 43 | help="include time column on output (HH:MM:SS)") |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 44 | parser.add_argument("-t", "--timestamp", action="store_true", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 45 | help="include timestamp on output") |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 46 | parser.add_argument("-p", "--pid", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 47 | help="trace this PID only") |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 48 | parser.add_argument("-P", "--port", |
| 49 | help="comma-separated list of local ports to trace") |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 50 | group = parser.add_mutually_exclusive_group() |
| 51 | group.add_argument("-4", "--ipv4", action="store_true", |
| 52 | help="trace IPv4 family only") |
| 53 | group.add_argument("-6", "--ipv6", action="store_true", |
| 54 | help="trace IPv6 family only") |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 55 | parser.add_argument("--cgroupmap", |
| 56 | help="trace cgroups in this BPF map only") |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 57 | parser.add_argument("--mntnsmap", |
| 58 | help="trace mount namespaces in this BPF map only") |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 59 | parser.add_argument("--ebpf", action="store_true", |
| 60 | help=argparse.SUPPRESS) |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 61 | args = parser.parse_args() |
| 62 | debug = 0 |
| 63 | |
| 64 | # define BPF program |
| 65 | bpf_text = """ |
| 66 | #include <uapi/linux/ptrace.h> |
| 67 | #include <net/sock.h> |
| 68 | #include <bcc/proto.h> |
| 69 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 70 | // separate data structs for ipv4 and ipv6 |
| 71 | struct ipv4_data_t { |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 72 | u64 ts_us; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 73 | u32 pid; |
Joe Yin | 365eade | 2018-06-21 13:41:03 +0800 | [diff] [blame] | 74 | u32 saddr; |
| 75 | u32 daddr; |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 76 | u64 ip; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 77 | u16 lport; |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 78 | u16 dport; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 79 | char task[TASK_COMM_LEN]; |
| 80 | }; |
| 81 | BPF_PERF_OUTPUT(ipv4_events); |
| 82 | |
| 83 | struct ipv6_data_t { |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 84 | u64 ts_us; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 85 | u32 pid; |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 86 | unsigned __int128 saddr; |
| 87 | unsigned __int128 daddr; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 88 | u64 ip; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 89 | u16 lport; |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 90 | u16 dport; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 91 | char task[TASK_COMM_LEN]; |
| 92 | }; |
| 93 | BPF_PERF_OUTPUT(ipv6_events); |
Joe Yin | 365eade | 2018-06-21 13:41:03 +0800 | [diff] [blame] | 94 | """ |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 95 | |
Joe Yin | 365eade | 2018-06-21 13:41:03 +0800 | [diff] [blame] | 96 | # |
Xiaozhou Liu | fd73745 | 2019-04-10 23:35:16 +0800 | [diff] [blame] | 97 | # The following code uses kprobes to instrument inet_csk_accept(). |
| 98 | # On Linux 4.16 and later, we could use sock:inet_sock_set_state |
Michael Prokop | c14d02a | 2020-01-09 02:29:18 +0100 | [diff] [blame] | 99 | # tracepoint for efficiency, but it may output wrong PIDs. This is |
Xiaozhou Liu | fd73745 | 2019-04-10 23:35:16 +0800 | [diff] [blame] | 100 | # because sock:inet_sock_set_state may run outside of process context. |
| 101 | # Hence, we stick to kprobes until we find a proper solution. |
Joe Yin | 365eade | 2018-06-21 13:41:03 +0800 | [diff] [blame] | 102 | # |
| 103 | bpf_text_kprobe = """ |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 104 | int kretprobe__inet_csk_accept(struct pt_regs *ctx) |
| 105 | { |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 106 | if (container_should_be_filtered()) { |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 107 | return 0; |
| 108 | } |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 109 | |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 110 | struct sock *newsk = (struct sock *)PT_REGS_RC(ctx); |
Brendan Gregg | 8cd3efd | 2019-04-07 12:32:53 -0700 | [diff] [blame] | 111 | u32 pid = bpf_get_current_pid_tgid() >> 32; |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 112 | |
detailyang | 54044d5 | 2019-01-10 00:43:39 +0800 | [diff] [blame] | 113 | ##FILTER_PID## |
| 114 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 115 | if (newsk == NULL) |
| 116 | return 0; |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 117 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 118 | // check this is TCP |
Nikolay Borisov | 2895551 | 2022-02-11 15:33:35 +0000 | [diff] [blame] | 119 | u16 protocol = 0; |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 120 | // workaround for reading the sk_protocol bitfield: |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 121 | |
Joe Yin | 116bb40 | 2018-06-18 23:34:52 +0800 | [diff] [blame] | 122 | // Following comments add by Joe Yin: |
| 123 | // Unfortunately,it can not work since Linux 4.10, |
| 124 | // because the sk_wmem_queued is not following the bitfield of sk_protocol. |
| 125 | // And the following member is sk_gso_max_segs. |
| 126 | // So, we can use this: |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 127 | // bpf_probe_read_kernel(&protocol, 1, (void *)((u64)&newsk->sk_gso_max_segs) - 3); |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 128 | // In order to diff the pre-4.10 and 4.10+ ,introduce the variables gso_max_segs_offset,sk_lingertime, |
| 129 | // sk_lingertime is closed to the gso_max_segs_offset,and |
| 130 | // the offset between the two members is 4 |
Joe Yin | 116bb40 | 2018-06-18 23:34:52 +0800 | [diff] [blame] | 131 | |
| 132 | int gso_max_segs_offset = offsetof(struct sock, sk_gso_max_segs); |
| 133 | int sk_lingertime_offset = offsetof(struct sock, sk_lingertime); |
| 134 | |
Nikolay Borisov | 2895551 | 2022-02-11 15:33:35 +0000 | [diff] [blame] | 135 | |
| 136 | // Since kernel v5.6 sk_protocol is its own u16 field and gso_max_segs |
| 137 | // precedes sk_lingertime. |
| 138 | if (sk_lingertime_offset - gso_max_segs_offset == 2) |
| 139 | protocol = newsk->sk_protocol; |
| 140 | else if (sk_lingertime_offset - gso_max_segs_offset == 4) |
Joe Yin | 116bb40 | 2018-06-18 23:34:52 +0800 | [diff] [blame] | 141 | // 4.10+ with little endian |
| 142 | #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ |
Paul Chaignon | 8d78edd | 2018-06-29 07:47:44 +0200 | [diff] [blame] | 143 | protocol = *(u8 *)((u64)&newsk->sk_gso_max_segs - 3); |
Joe Yin | 116bb40 | 2018-06-18 23:34:52 +0800 | [diff] [blame] | 144 | else |
| 145 | // pre-4.10 with little endian |
Paul Chaignon | 8d78edd | 2018-06-29 07:47:44 +0200 | [diff] [blame] | 146 | protocol = *(u8 *)((u64)&newsk->sk_wmem_queued - 3); |
Joe Yin | 116bb40 | 2018-06-18 23:34:52 +0800 | [diff] [blame] | 147 | #elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ |
| 148 | // 4.10+ with big endian |
Paul Chaignon | 8d78edd | 2018-06-29 07:47:44 +0200 | [diff] [blame] | 149 | protocol = *(u8 *)((u64)&newsk->sk_gso_max_segs - 1); |
Joe Yin | 116bb40 | 2018-06-18 23:34:52 +0800 | [diff] [blame] | 150 | else |
| 151 | // pre-4.10 with big endian |
Paul Chaignon | 8d78edd | 2018-06-29 07:47:44 +0200 | [diff] [blame] | 152 | protocol = *(u8 *)((u64)&newsk->sk_wmem_queued - 1); |
Joe Yin | 116bb40 | 2018-06-18 23:34:52 +0800 | [diff] [blame] | 153 | #else |
| 154 | # error "Fix your compiler's __BYTE_ORDER__?!" |
| 155 | #endif |
| 156 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 157 | if (protocol != IPPROTO_TCP) |
| 158 | return 0; |
Brendan Gregg | 10e1b14 | 2015-10-13 16:35:25 -0700 | [diff] [blame] | 159 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 160 | // pull in details |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 161 | u16 family = 0, lport = 0, dport; |
Paul Chaignon | a9f96c0 | 2018-06-15 00:27:08 +0200 | [diff] [blame] | 162 | family = newsk->__sk_common.skc_family; |
| 163 | lport = newsk->__sk_common.skc_num; |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 164 | dport = newsk->__sk_common.skc_dport; |
| 165 | dport = ntohs(dport); |
| 166 | |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 167 | ##FILTER_FAMILY## |
| 168 | |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 169 | ##FILTER_PORT## |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 170 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 171 | if (family == AF_INET) { |
| 172 | struct ipv4_data_t data4 = {.pid = pid, .ip = 4}; |
| 173 | data4.ts_us = bpf_ktime_get_ns() / 1000; |
Paul Chaignon | a9f96c0 | 2018-06-15 00:27:08 +0200 | [diff] [blame] | 174 | data4.saddr = newsk->__sk_common.skc_rcv_saddr; |
| 175 | data4.daddr = newsk->__sk_common.skc_daddr; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 176 | data4.lport = lport; |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 177 | data4.dport = dport; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 178 | bpf_get_current_comm(&data4.task, sizeof(data4.task)); |
| 179 | ipv4_events.perf_submit(ctx, &data4, sizeof(data4)); |
| 180 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 181 | } else if (family == AF_INET6) { |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 182 | struct ipv6_data_t data6 = {.pid = pid, .ip = 6}; |
| 183 | data6.ts_us = bpf_ktime_get_ns() / 1000; |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 184 | bpf_probe_read_kernel(&data6.saddr, sizeof(data6.saddr), |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 185 | &newsk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 186 | bpf_probe_read_kernel(&data6.daddr, sizeof(data6.daddr), |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 187 | &newsk->__sk_common.skc_v6_daddr.in6_u.u6_addr32); |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 188 | data6.lport = lport; |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 189 | data6.dport = dport; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 190 | bpf_get_current_comm(&data6.task, sizeof(data6.task)); |
| 191 | ipv6_events.perf_submit(ctx, &data6, sizeof(data6)); |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 192 | } |
| 193 | // else drop |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 194 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 195 | return 0; |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 196 | } |
| 197 | """ |
| 198 | |
Xiaozhou Liu | fd73745 | 2019-04-10 23:35:16 +0800 | [diff] [blame] | 199 | bpf_text += bpf_text_kprobe |
Joe Yin | 365eade | 2018-06-21 13:41:03 +0800 | [diff] [blame] | 200 | |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 201 | # code substitutions |
| 202 | if args.pid: |
detailyang | 54044d5 | 2019-01-10 00:43:39 +0800 | [diff] [blame] | 203 | bpf_text = bpf_text.replace('##FILTER_PID##', |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 204 | 'if (pid != %s) { return 0; }' % args.pid) |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 205 | else: |
detailyang | 54044d5 | 2019-01-10 00:43:39 +0800 | [diff] [blame] | 206 | bpf_text = bpf_text.replace('##FILTER_PID##', '') |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 207 | if args.port: |
| 208 | lports = [int(lport) for lport in args.port.split(',')] |
| 209 | lports_if = ' && '.join(['lport != %d' % lport for lport in lports]) |
| 210 | bpf_text = bpf_text.replace('##FILTER_PORT##', |
| 211 | 'if (%s) { return 0; }' % lports_if) |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 212 | if args.ipv4: |
| 213 | bpf_text = bpf_text.replace('##FILTER_FAMILY##', |
| 214 | 'if (family != AF_INET) { return 0; }') |
| 215 | elif args.ipv6: |
| 216 | bpf_text = bpf_text.replace('##FILTER_FAMILY##', |
| 217 | 'if (family != AF_INET6) { return 0; }') |
| 218 | |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 219 | bpf_text = filter_by_containers(args) + bpf_text |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 220 | if debug or args.ebpf: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 221 | print(bpf_text) |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 222 | if args.ebpf: |
| 223 | exit() |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 224 | |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 225 | bpf_text = bpf_text.replace('##FILTER_PORT##', '') |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 226 | bpf_text = bpf_text.replace('##FILTER_FAMILY##', '') |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 227 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 228 | # process event |
| 229 | def print_ipv4_event(cpu, data, size): |
Xiaozhou Liu | 51d62d3 | 2019-02-15 13:03:05 +0800 | [diff] [blame] | 230 | event = b["ipv4_events"].event(data) |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 231 | global start_ts |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 232 | if args.time: |
Gary Lin | 6c79331 | 2019-04-18 15:17:56 +0800 | [diff] [blame] | 233 | printb(b"%-9s" % strftime("%H:%M:%S").encode('ascii'), nl="") |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 234 | if args.timestamp: |
| 235 | if start_ts == 0: |
| 236 | start_ts = event.ts_us |
Gary Lin | 6c79331 | 2019-04-18 15:17:56 +0800 | [diff] [blame] | 237 | printb(b"%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), nl="") |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 238 | printb(b"%-7d %-12.12s %-2d %-16s %-5d %-16s %-5d" % (event.pid, |
Yonghong Song | ebe1951 | 2019-01-10 14:54:16 -0800 | [diff] [blame] | 239 | event.task, event.ip, |
| 240 | inet_ntop(AF_INET, pack("I", event.daddr)).encode(), |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 241 | event.dport, |
Yonghong Song | ebe1951 | 2019-01-10 14:54:16 -0800 | [diff] [blame] | 242 | inet_ntop(AF_INET, pack("I", event.saddr)).encode(), |
| 243 | event.lport)) |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 244 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 245 | def print_ipv6_event(cpu, data, size): |
Xiaozhou Liu | 51d62d3 | 2019-02-15 13:03:05 +0800 | [diff] [blame] | 246 | event = b["ipv6_events"].event(data) |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 247 | global start_ts |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 248 | if args.time: |
Gary Lin | 6c79331 | 2019-04-18 15:17:56 +0800 | [diff] [blame] | 249 | printb(b"%-9s" % strftime("%H:%M:%S").encode('ascii'), nl="") |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 250 | if args.timestamp: |
| 251 | if start_ts == 0: |
| 252 | start_ts = event.ts_us |
Gary Lin | 6c79331 | 2019-04-18 15:17:56 +0800 | [diff] [blame] | 253 | printb(b"%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), nl="") |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 254 | printb(b"%-7d %-12.12s %-2d %-16s %-5d %-16s %-5d" % (event.pid, |
Yonghong Song | ebe1951 | 2019-01-10 14:54:16 -0800 | [diff] [blame] | 255 | event.task, event.ip, |
| 256 | inet_ntop(AF_INET6, event.daddr).encode(), |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 257 | event.dport, |
Yonghong Song | ebe1951 | 2019-01-10 14:54:16 -0800 | [diff] [blame] | 258 | inet_ntop(AF_INET6, event.saddr).encode(), |
jeromemarchand | b96ebcd | 2018-10-10 01:58:15 +0200 | [diff] [blame] | 259 | event.lport)) |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 260 | |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 261 | # initialize BPF |
| 262 | b = BPF(text=bpf_text) |
| 263 | |
| 264 | # header |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 265 | if args.time: |
| 266 | print("%-9s" % ("TIME"), end="") |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 267 | if args.timestamp: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 268 | print("%-9s" % ("TIME(s)"), end="") |
Xiaozhou Liu | 701bd73 | 2019-03-08 13:46:28 +0800 | [diff] [blame] | 269 | print("%-7s %-12s %-2s %-16s %-5s %-16s %-5s" % ("PID", "COMM", "IP", "RADDR", |
| 270 | "RPORT", "LADDR", "LPORT")) |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 271 | |
| 272 | start_ts = 0 |
| 273 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 274 | # read events |
| 275 | b["ipv4_events"].open_perf_buffer(print_ipv4_event) |
| 276 | b["ipv6_events"].open_perf_buffer(print_ipv6_event) |
Brendan Gregg | 052f89c | 2015-10-13 15:35:58 -0700 | [diff] [blame] | 277 | while 1: |
Jerome Marchand | 5167127 | 2018-12-19 01:57:24 +0100 | [diff] [blame] | 278 | try: |
| 279 | b.perf_buffer_poll() |
| 280 | except KeyboardInterrupt: |
| 281 | exit() |