Alexey Ivanov | cc01a9c | 2019-01-16 09:50:46 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 2 | # @lint-avoid-python-3-compatibility-imports |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 3 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 4 | # tcpconnect Trace TCP connect()s. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 6 | # |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 7 | # USAGE: tcpconnect [-h] [-c] [-t] [-p PID] [-P PORT [PORT ...]] [-4 | -6] |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 8 | # |
| 9 | # All connection attempts are traced, even if they ultimately fail. |
| 10 | # |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 11 | # This uses dynamic tracing of kernel functions, and will need to be updated |
| 12 | # to match kernel changes. |
| 13 | # |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 14 | # Copyright (c) 2015 Brendan Gregg. |
| 15 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 16 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 17 | # 25-Sep-2015 Brendan Gregg Created this. |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 18 | # 14-Feb-2016 " " Switch to bpf_perf_output. |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 19 | # 09-Jan-2019 Takuma Kume Support filtering by UID |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 20 | # 30-Jul-2019 Xiaozhou Liu Count connects. |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 21 | # 07-Oct-2020 Nabil Schear Correlate connects with DNS responses |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 22 | # 08-Mar-2021 Suresh Kumar Added LPORT option |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 23 | |
| 24 | from __future__ import print_function |
| 25 | from bcc import BPF |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 26 | from bcc.containers import filter_by_containers |
japroc | aed9b1e | 2019-01-04 20:21:46 +0300 | [diff] [blame] | 27 | from bcc.utils import printb |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 28 | import argparse |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 29 | from socket import inet_ntop, ntohs, AF_INET, AF_INET6 |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 30 | from struct import pack |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 31 | from time import sleep |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 32 | from datetime import datetime |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 33 | |
| 34 | # arguments |
| 35 | examples = """examples: |
| 36 | ./tcpconnect # trace all TCP connect()s |
| 37 | ./tcpconnect -t # include timestamps |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 38 | ./tcpconnect -d # include DNS queries associated with connects |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 39 | ./tcpconnect -p 181 # only trace PID 181 |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 40 | ./tcpconnect -P 80 # only trace port 80 |
| 41 | ./tcpconnect -P 80,81 # only trace port 80 and 81 |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 42 | ./tcpconnect -4 # only trace IPv4 family |
| 43 | ./tcpconnect -6 # only trace IPv6 family |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 44 | ./tcpconnect -U # include UID |
| 45 | ./tcpconnect -u 1000 # only trace UID 1000 |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 46 | ./tcpconnect -c # count connects per src ip and dest ip/port |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 47 | ./tcpconnect -L # include LPORT while printing outputs |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 48 | ./tcpconnect --cgroupmap mappath # only trace cgroups in this BPF map |
| 49 | ./tcpconnect --mntnsmap mappath # only trace mount namespaces in the map |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 50 | """ |
| 51 | parser = argparse.ArgumentParser( |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 52 | description="Trace TCP connects", |
| 53 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 54 | epilog=examples) |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 55 | parser.add_argument("-t", "--timestamp", action="store_true", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 56 | help="include timestamp on output") |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 57 | parser.add_argument("-p", "--pid", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 58 | help="trace this PID only") |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 59 | parser.add_argument("-P", "--port", |
| 60 | help="comma-separated list of destination ports to trace.") |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 61 | group = parser.add_mutually_exclusive_group() |
| 62 | group.add_argument("-4", "--ipv4", action="store_true", |
| 63 | help="trace IPv4 family only") |
| 64 | group.add_argument("-6", "--ipv6", action="store_true", |
| 65 | help="trace IPv6 family only") |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 66 | parser.add_argument("-L", "--lport", action="store_true", |
| 67 | help="include LPORT on output") |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 68 | parser.add_argument("-U", "--print-uid", action="store_true", |
| 69 | help="include UID on output") |
| 70 | parser.add_argument("-u", "--uid", |
| 71 | help="trace this UID only") |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 72 | parser.add_argument("-c", "--count", action="store_true", |
| 73 | help="count connects per src ip and dest ip/port") |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 74 | parser.add_argument("--cgroupmap", |
| 75 | help="trace cgroups in this BPF map only") |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 76 | parser.add_argument("--mntnsmap", |
| 77 | help="trace mount namespaces in this BPF map only") |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 78 | parser.add_argument("-d", "--dns", action="store_true", |
| 79 | help="include likely DNS query associated with each connect") |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 80 | parser.add_argument("--ebpf", action="store_true", |
| 81 | help=argparse.SUPPRESS) |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 82 | args = parser.parse_args() |
| 83 | debug = 0 |
| 84 | |
| 85 | # define BPF program |
| 86 | bpf_text = """ |
| 87 | #include <uapi/linux/ptrace.h> |
| 88 | #include <net/sock.h> |
| 89 | #include <bcc/proto.h> |
| 90 | |
| 91 | BPF_HASH(currsock, u32, struct sock *); |
| 92 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 93 | // separate data structs for ipv4 and ipv6 |
| 94 | struct ipv4_data_t { |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 95 | u64 ts_us; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 96 | u32 pid; |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 97 | u32 uid; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 98 | u32 saddr; |
| 99 | u32 daddr; |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 100 | u64 ip; |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 101 | u16 lport; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 102 | u16 dport; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 103 | char task[TASK_COMM_LEN]; |
| 104 | }; |
| 105 | BPF_PERF_OUTPUT(ipv4_events); |
| 106 | |
| 107 | struct ipv6_data_t { |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 108 | u64 ts_us; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 109 | u32 pid; |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 110 | u32 uid; |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 111 | unsigned __int128 saddr; |
| 112 | unsigned __int128 daddr; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 113 | u64 ip; |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 114 | u16 lport; |
Joe Yin | 36ce112 | 2018-08-17 06:04:00 +0800 | [diff] [blame] | 115 | u16 dport; |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 116 | char task[TASK_COMM_LEN]; |
| 117 | }; |
| 118 | BPF_PERF_OUTPUT(ipv6_events); |
| 119 | |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 120 | // separate flow keys per address family |
| 121 | struct ipv4_flow_key_t { |
| 122 | u32 saddr; |
| 123 | u32 daddr; |
| 124 | u16 dport; |
| 125 | }; |
| 126 | BPF_HASH(ipv4_count, struct ipv4_flow_key_t); |
| 127 | |
| 128 | struct ipv6_flow_key_t { |
| 129 | unsigned __int128 saddr; |
| 130 | unsigned __int128 daddr; |
| 131 | u16 dport; |
| 132 | }; |
| 133 | BPF_HASH(ipv6_count, struct ipv6_flow_key_t); |
| 134 | |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 135 | int trace_connect_entry(struct pt_regs *ctx, struct sock *sk) |
| 136 | { |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 137 | if (container_should_be_filtered()) { |
| 138 | return 0; |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 139 | } |
Alban Crequy | 1ce868f | 2020-02-19 17:07:41 +0100 | [diff] [blame] | 140 | |
Brendan Gregg | 8cd3efd | 2019-04-07 12:32:53 -0700 | [diff] [blame] | 141 | u64 pid_tgid = bpf_get_current_pid_tgid(); |
| 142 | u32 pid = pid_tgid >> 32; |
| 143 | u32 tid = pid_tgid; |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 144 | FILTER_PID |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 145 | |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 146 | u32 uid = bpf_get_current_uid_gid(); |
| 147 | FILTER_UID |
| 148 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 149 | // stash the sock ptr for lookup on return |
Brendan Gregg | 8cd3efd | 2019-04-07 12:32:53 -0700 | [diff] [blame] | 150 | currsock.update(&tid, &sk); |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 151 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 152 | return 0; |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 153 | }; |
| 154 | |
| 155 | static int trace_connect_return(struct pt_regs *ctx, short ipver) |
| 156 | { |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 157 | int ret = PT_REGS_RC(ctx); |
Brendan Gregg | 8cd3efd | 2019-04-07 12:32:53 -0700 | [diff] [blame] | 158 | u64 pid_tgid = bpf_get_current_pid_tgid(); |
| 159 | u32 pid = pid_tgid >> 32; |
| 160 | u32 tid = pid_tgid; |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 161 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 162 | struct sock **skpp; |
Brendan Gregg | 8cd3efd | 2019-04-07 12:32:53 -0700 | [diff] [blame] | 163 | skpp = currsock.lookup(&tid); |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 164 | if (skpp == 0) { |
| 165 | return 0; // missed entry |
| 166 | } |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 167 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 168 | if (ret != 0) { |
| 169 | // failed to send SYNC packet, may not have populated |
| 170 | // socket __sk_common.{skc_rcv_saddr, ...} |
Brendan Gregg | 8cd3efd | 2019-04-07 12:32:53 -0700 | [diff] [blame] | 171 | currsock.delete(&tid); |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 172 | return 0; |
| 173 | } |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 174 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 175 | // pull in details |
| 176 | struct sock *skp = *skpp; |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 177 | u16 lport = skp->__sk_common.skc_num; |
Paul Chaignon | eae0acf | 2017-08-05 23:04:41 +0200 | [diff] [blame] | 178 | u16 dport = skp->__sk_common.skc_dport; |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 179 | |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 180 | FILTER_PORT |
Hengqi Chen | 6ff0511 | 2022-02-19 17:42:23 +0800 | [diff] [blame] | 181 | |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 182 | FILTER_FAMILY |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 183 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 184 | if (ipver == 4) { |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 185 | IPV4_CODE |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 186 | } else /* 6 */ { |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 187 | IPV6_CODE |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 188 | } |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 189 | |
Brendan Gregg | 8cd3efd | 2019-04-07 12:32:53 -0700 | [diff] [blame] | 190 | currsock.delete(&tid); |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 191 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 192 | return 0; |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 193 | } |
| 194 | |
| 195 | int trace_connect_v4_return(struct pt_regs *ctx) |
| 196 | { |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 197 | return trace_connect_return(ctx, 4); |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 198 | } |
| 199 | |
| 200 | int trace_connect_v6_return(struct pt_regs *ctx) |
| 201 | { |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 202 | return trace_connect_return(ctx, 6); |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 203 | } |
| 204 | """ |
| 205 | |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 206 | struct_init = {'ipv4': |
| 207 | {'count': |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 208 | """ |
| 209 | struct ipv4_flow_key_t flow_key = {}; |
| 210 | flow_key.saddr = skp->__sk_common.skc_rcv_saddr; |
| 211 | flow_key.daddr = skp->__sk_common.skc_daddr; |
| 212 | flow_key.dport = ntohs(dport); |
| 213 | ipv4_count.increment(flow_key);""", |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 214 | 'trace': |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 215 | """ |
| 216 | struct ipv4_data_t data4 = {.pid = pid, .ip = ipver}; |
| 217 | data4.uid = bpf_get_current_uid_gid(); |
| 218 | data4.ts_us = bpf_ktime_get_ns() / 1000; |
| 219 | data4.saddr = skp->__sk_common.skc_rcv_saddr; |
| 220 | data4.daddr = skp->__sk_common.skc_daddr; |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 221 | data4.lport = lport; |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 222 | data4.dport = ntohs(dport); |
| 223 | bpf_get_current_comm(&data4.task, sizeof(data4.task)); |
| 224 | ipv4_events.perf_submit(ctx, &data4, sizeof(data4));""" |
| 225 | }, |
| 226 | 'ipv6': |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 227 | {'count': |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 228 | """ |
| 229 | struct ipv6_flow_key_t flow_key = {}; |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 230 | bpf_probe_read_kernel(&flow_key.saddr, sizeof(flow_key.saddr), |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 231 | skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 232 | bpf_probe_read_kernel(&flow_key.daddr, sizeof(flow_key.daddr), |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 233 | skp->__sk_common.skc_v6_daddr.in6_u.u6_addr32); |
| 234 | flow_key.dport = ntohs(dport); |
| 235 | ipv6_count.increment(flow_key);""", |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 236 | 'trace': |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 237 | """ |
| 238 | struct ipv6_data_t data6 = {.pid = pid, .ip = ipver}; |
| 239 | data6.uid = bpf_get_current_uid_gid(); |
| 240 | data6.ts_us = bpf_ktime_get_ns() / 1000; |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 241 | bpf_probe_read_kernel(&data6.saddr, sizeof(data6.saddr), |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 242 | skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 243 | bpf_probe_read_kernel(&data6.daddr, sizeof(data6.daddr), |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 244 | skp->__sk_common.skc_v6_daddr.in6_u.u6_addr32); |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 245 | data6.lport = lport; |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 246 | data6.dport = ntohs(dport); |
| 247 | bpf_get_current_comm(&data6.task, sizeof(data6.task)); |
| 248 | ipv6_events.perf_submit(ctx, &data6, sizeof(data6));""" |
| 249 | } |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 250 | } |
| 251 | |
| 252 | # This defines an additional BPF program that instruments udp_recvmsg system |
| 253 | # call to locate DNS response packets on UDP port 53. When these packets are |
| 254 | # located, the data is copied to user-space where python will parse them with |
| 255 | # dnslib. |
| 256 | # |
| 257 | # uses a percpu array of length 1 to store the dns_data_t off the stack to |
| 258 | # allow for a maximum DNS packet length of 512 bytes. |
| 259 | dns_bpf_text = """ |
| 260 | #include <net/inet_sock.h> |
| 261 | |
| 262 | #define MAX_PKT 512 |
| 263 | struct dns_data_t { |
| 264 | u8 pkt[MAX_PKT]; |
| 265 | }; |
| 266 | |
| 267 | BPF_PERF_OUTPUT(dns_events); |
| 268 | |
| 269 | // store msghdr pointer captured on syscall entry to parse on syscall return |
| 270 | BPF_HASH(tbl_udp_msg_hdr, u64, struct msghdr *); |
| 271 | |
| 272 | // single element per-cpu array to hold the current event off the stack |
| 273 | BPF_PERCPU_ARRAY(dns_data,struct dns_data_t,1); |
| 274 | |
| 275 | int trace_udp_recvmsg(struct pt_regs *ctx) |
| 276 | { |
| 277 | __u64 pid_tgid = bpf_get_current_pid_tgid(); |
| 278 | struct sock *sk = (struct sock *)PT_REGS_PARM1(ctx); |
| 279 | struct inet_sock *is = inet_sk(sk); |
| 280 | |
| 281 | // only grab port 53 packets, 13568 is ntohs(53) |
| 282 | if (is->inet_dport == 13568) { |
| 283 | struct msghdr *msghdr = (struct msghdr *)PT_REGS_PARM2(ctx); |
| 284 | tbl_udp_msg_hdr.update(&pid_tgid, &msghdr); |
| 285 | } |
| 286 | return 0; |
| 287 | } |
| 288 | |
| 289 | int trace_udp_ret_recvmsg(struct pt_regs *ctx) |
| 290 | { |
| 291 | __u64 pid_tgid = bpf_get_current_pid_tgid(); |
| 292 | u32 zero = 0; |
| 293 | struct msghdr **msgpp = tbl_udp_msg_hdr.lookup(&pid_tgid); |
| 294 | if (msgpp == 0) |
| 295 | return 0; |
| 296 | |
| 297 | struct msghdr *msghdr = (struct msghdr *)*msgpp; |
Hengqi Chen | 6ff0511 | 2022-02-19 17:42:23 +0800 | [diff] [blame] | 298 | if (msghdr->msg_iter.TYPE_FIELD != ITER_IOVEC) |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 299 | goto delete_and_return; |
| 300 | |
| 301 | int copied = (int)PT_REGS_RC(ctx); |
| 302 | if (copied < 0) |
| 303 | goto delete_and_return; |
| 304 | size_t buflen = (size_t)copied; |
| 305 | |
| 306 | if (buflen > msghdr->msg_iter.iov->iov_len) |
| 307 | goto delete_and_return; |
| 308 | |
| 309 | if (buflen > MAX_PKT) |
| 310 | buflen = MAX_PKT; |
| 311 | |
| 312 | struct dns_data_t *data = dns_data.lookup(&zero); |
| 313 | if (!data) // this should never happen, just making the verifier happy |
| 314 | return 0; |
| 315 | |
| 316 | void *iovbase = msghdr->msg_iter.iov->iov_base; |
| 317 | bpf_probe_read(data->pkt, buflen, iovbase); |
| 318 | dns_events.perf_submit(ctx, data, buflen); |
| 319 | |
| 320 | delete_and_return: |
| 321 | tbl_udp_msg_hdr.delete(&pid_tgid); |
| 322 | return 0; |
| 323 | } |
| 324 | |
| 325 | """ |
| 326 | |
| 327 | if args.count and args.dns: |
| 328 | print("Error: you may not specify -d/--dns with -c/--count.") |
| 329 | exit() |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 330 | |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 331 | # code substitutions |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 332 | if args.count: |
| 333 | bpf_text = bpf_text.replace("IPV4_CODE", struct_init['ipv4']['count']) |
| 334 | bpf_text = bpf_text.replace("IPV6_CODE", struct_init['ipv6']['count']) |
| 335 | else: |
| 336 | bpf_text = bpf_text.replace("IPV4_CODE", struct_init['ipv4']['trace']) |
| 337 | bpf_text = bpf_text.replace("IPV6_CODE", struct_init['ipv6']['trace']) |
| 338 | |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 339 | if args.pid: |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 340 | bpf_text = bpf_text.replace('FILTER_PID', |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 341 | 'if (pid != %s) { return 0; }' % args.pid) |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 342 | if args.port: |
| 343 | dports = [int(dport) for dport in args.port.split(',')] |
| 344 | dports_if = ' && '.join(['dport != %d' % ntohs(dport) for dport in dports]) |
| 345 | bpf_text = bpf_text.replace('FILTER_PORT', |
Mauricio Vásquez | 884799f | 2020-10-07 20:11:25 -0500 | [diff] [blame] | 346 | 'if (%s) { currsock.delete(&tid); return 0; }' % dports_if) |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 347 | if args.ipv4: |
| 348 | bpf_text = bpf_text.replace('FILTER_FAMILY', |
| 349 | 'if (ipver != 4) { return 0; }') |
| 350 | elif args.ipv6: |
| 351 | bpf_text = bpf_text.replace('FILTER_FAMILY', |
| 352 | 'if (ipver != 6) { return 0; }') |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 353 | if args.uid: |
| 354 | bpf_text = bpf_text.replace('FILTER_UID', |
| 355 | 'if (uid != %s) { return 0; }' % args.uid) |
Alban Crequy | 32ab858 | 2020-03-22 16:06:44 +0100 | [diff] [blame] | 356 | bpf_text = filter_by_containers(args) + bpf_text |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 357 | |
| 358 | bpf_text = bpf_text.replace('FILTER_PID', '') |
| 359 | bpf_text = bpf_text.replace('FILTER_PORT', '') |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 360 | bpf_text = bpf_text.replace('FILTER_FAMILY', '') |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 361 | bpf_text = bpf_text.replace('FILTER_UID', '') |
chantra | 5293805 | 2016-09-10 09:44:50 -0700 | [diff] [blame] | 362 | |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 363 | if args.dns: |
Hengqi Chen | 6ff0511 | 2022-02-19 17:42:23 +0800 | [diff] [blame] | 364 | if BPF.kernel_struct_has_field(b'iov_iter', b'iter_type') == 1: |
| 365 | dns_bpf_text = dns_bpf_text.replace('TYPE_FIELD', 'iter_type') |
| 366 | else: |
| 367 | dns_bpf_text = dns_bpf_text.replace('TYPE_FIELD', 'type') |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 368 | bpf_text += dns_bpf_text |
| 369 | |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 370 | if debug or args.ebpf: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 371 | print(bpf_text) |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 372 | if args.ebpf: |
| 373 | exit() |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 374 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 375 | # process event |
| 376 | def print_ipv4_event(cpu, data, size): |
Xiaozhou Liu | 3156303 | 2019-02-14 14:33:58 +0800 | [diff] [blame] | 377 | event = b["ipv4_events"].event(data) |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 378 | global start_ts |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 379 | if args.timestamp: |
| 380 | if start_ts == 0: |
| 381 | start_ts = event.ts_us |
Gary Lin | 6c79331 | 2019-04-18 15:17:56 +0800 | [diff] [blame] | 382 | printb(b"%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), nl="") |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 383 | if args.print_uid: |
Gary Lin | 6c79331 | 2019-04-18 15:17:56 +0800 | [diff] [blame] | 384 | printb(b"%-6d" % event.uid, nl="") |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 385 | dest_ip = inet_ntop(AF_INET, pack("I", event.daddr)).encode() |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 386 | if args.lport: |
xingfeng2510 | 03e4948 | 2022-03-17 13:07:16 +0800 | [diff] [blame] | 387 | printb(b"%-7d %-12.12s %-2d %-16s %-6d %-16s %-6d %s" % (event.pid, |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 388 | event.task, event.ip, |
| 389 | inet_ntop(AF_INET, pack("I", event.saddr)).encode(), event.lport, |
| 390 | dest_ip, event.dport, print_dns(dest_ip))) |
| 391 | else: |
xingfeng2510 | 03e4948 | 2022-03-17 13:07:16 +0800 | [diff] [blame] | 392 | printb(b"%-7d %-12.12s %-2d %-16s %-16s %-6d %s" % (event.pid, |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 393 | event.task, event.ip, |
| 394 | inet_ntop(AF_INET, pack("I", event.saddr)).encode(), |
| 395 | dest_ip, event.dport, print_dns(dest_ip))) |
Brendan Gregg | 9e0b087 | 2016-03-28 12:11:45 -0700 | [diff] [blame] | 396 | |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 397 | def print_ipv6_event(cpu, data, size): |
Xiaozhou Liu | 3156303 | 2019-02-14 14:33:58 +0800 | [diff] [blame] | 398 | event = b["ipv6_events"].event(data) |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 399 | global start_ts |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 400 | if args.timestamp: |
| 401 | if start_ts == 0: |
| 402 | start_ts = event.ts_us |
Gary Lin | 6c79331 | 2019-04-18 15:17:56 +0800 | [diff] [blame] | 403 | printb(b"%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), nl="") |
Takuma Kume | b181a8e | 2019-01-10 05:49:59 +0900 | [diff] [blame] | 404 | if args.print_uid: |
Gary Lin | 6c79331 | 2019-04-18 15:17:56 +0800 | [diff] [blame] | 405 | printb(b"%-6d" % event.uid, nl="") |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 406 | dest_ip = inet_ntop(AF_INET6, event.daddr).encode() |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 407 | if args.lport: |
xingfeng2510 | 03e4948 | 2022-03-17 13:07:16 +0800 | [diff] [blame] | 408 | printb(b"%-7d %-12.12s %-2d %-16s %-6d %-16s %-6d %s" % (event.pid, |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 409 | event.task, event.ip, |
| 410 | inet_ntop(AF_INET6, event.saddr).encode(), event.lport, |
| 411 | dest_ip, event.dport, print_dns(dest_ip))) |
| 412 | else: |
xingfeng2510 | 03e4948 | 2022-03-17 13:07:16 +0800 | [diff] [blame] | 413 | printb(b"%-7d %-12.12s %-2d %-16s %-16s %-6d %s" % (event.pid, |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 414 | event.task, event.ip, |
| 415 | inet_ntop(AF_INET6, event.saddr).encode(), |
| 416 | dest_ip, event.dport, print_dns(dest_ip))) |
Brendan Gregg | 2482552 | 2016-02-14 16:32:29 -0800 | [diff] [blame] | 417 | |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 418 | def depict_cnt(counts_tab, l3prot='ipv4'): |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 419 | for k, v in sorted(counts_tab.items(), |
| 420 | key=lambda counts: counts[1].value, reverse=True): |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 421 | depict_key = "" |
| 422 | if l3prot == 'ipv4': |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 423 | depict_key = "%-25s %-25s %-20s" % \ |
| 424 | ((inet_ntop(AF_INET, pack('I', k.saddr))), |
| 425 | inet_ntop(AF_INET, pack('I', k.daddr)), k.dport) |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 426 | else: |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 427 | depict_key = "%-25s %-25s %-20s" % \ |
| 428 | ((inet_ntop(AF_INET6, k.saddr)), |
| 429 | inet_ntop(AF_INET6, k.daddr), k.dport) |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 430 | |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 431 | print("%s %-10d" % (depict_key, v.value)) |
| 432 | |
| 433 | def print_dns(dest_ip): |
| 434 | if not args.dns: |
| 435 | return b"" |
| 436 | |
| 437 | dnsname, timestamp = dns_cache.get(dest_ip, (None, None)) |
| 438 | if timestamp is not None: |
| 439 | diff = datetime.now() - timestamp |
| 440 | diff = float(diff.seconds) * 1000 + float(diff.microseconds) / 1000 |
| 441 | else: |
| 442 | diff = 0 |
| 443 | if dnsname is None: |
| 444 | dnsname = b"No DNS Query" |
| 445 | if dest_ip == b"127.0.0.1" or dest_ip == b"::1": |
| 446 | dnsname = b"localhost" |
| 447 | retval = b"%s" % dnsname |
| 448 | if diff > DELAY_DNS: |
| 449 | retval += b" (%.3fms)" % diff |
| 450 | return retval |
| 451 | |
| 452 | if args.dns: |
| 453 | try: |
| 454 | import dnslib |
| 455 | from cachetools import TTLCache |
| 456 | except ImportError: |
| 457 | print("Error: The python packages dnslib and cachetools are required " |
| 458 | "to use the -d/--dns option.") |
| 459 | print("Install this package with:") |
| 460 | print("\t$ pip3 install dnslib cachetools") |
| 461 | print(" or") |
| 462 | print("\t$ sudo apt-get install python3-dnslib python3-cachetools " |
| 463 | "(on Ubuntu 18.04+)") |
| 464 | exit(1) |
| 465 | |
| 466 | # 24 hours |
| 467 | DEFAULT_TTL = 86400 |
| 468 | |
| 469 | # Cache Size in entries |
| 470 | DNS_CACHE_SIZE = 10240 |
| 471 | |
| 472 | # delay in ms in which to warn users of long delay between the query |
| 473 | # and the connect that used the IP |
| 474 | DELAY_DNS = 100 |
| 475 | |
| 476 | dns_cache = TTLCache(maxsize=DNS_CACHE_SIZE, ttl=DEFAULT_TTL) |
| 477 | |
| 478 | # process event |
| 479 | def save_dns(cpu, data, size): |
| 480 | event = b["dns_events"].event(data) |
| 481 | payload = event.pkt[:size] |
| 482 | |
| 483 | # pass the payload to dnslib for parsing |
| 484 | dnspkt = dnslib.DNSRecord.parse(payload) |
| 485 | # lets only look at responses |
| 486 | if dnspkt.header.qr != 1: |
| 487 | return |
| 488 | # must be some questions in there |
| 489 | if dnspkt.header.q != 1: |
| 490 | return |
| 491 | # make sure there are answers |
| 492 | if dnspkt.header.a == 0 and dnspkt.header.aa == 0: |
| 493 | return |
| 494 | |
| 495 | # lop off the trailing . |
| 496 | question = ("%s" % dnspkt.q.qname)[:-1].encode('utf-8') |
| 497 | |
| 498 | for answer in dnspkt.rr: |
| 499 | # skip all but A and AAAA records |
| 500 | if answer.rtype == 1 or answer.rtype == 28: |
| 501 | dns_cache[str(answer.rdata).encode('utf-8')] = (question, |
| 502 | datetime.now()) |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 503 | |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 504 | # initialize BPF |
| 505 | b = BPF(text=bpf_text) |
| 506 | b.attach_kprobe(event="tcp_v4_connect", fn_name="trace_connect_entry") |
| 507 | b.attach_kprobe(event="tcp_v6_connect", fn_name="trace_connect_entry") |
| 508 | b.attach_kretprobe(event="tcp_v4_connect", fn_name="trace_connect_v4_return") |
| 509 | b.attach_kretprobe(event="tcp_v6_connect", fn_name="trace_connect_v6_return") |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 510 | if args.dns: |
| 511 | b.attach_kprobe(event="udp_recvmsg", fn_name="trace_udp_recvmsg") |
| 512 | b.attach_kretprobe(event="udp_recvmsg", fn_name="trace_udp_ret_recvmsg") |
Brendan Gregg | f06d3b4 | 2015-10-15 17:21:32 -0700 | [diff] [blame] | 513 | |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 514 | print("Tracing connect ... Hit Ctrl-C to end") |
| 515 | if args.count: |
Jerome Marchand | 5167127 | 2018-12-19 01:57:24 +0100 | [diff] [blame] | 516 | try: |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 517 | while True: |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 518 | sleep(99999999) |
Jerome Marchand | 5167127 | 2018-12-19 01:57:24 +0100 | [diff] [blame] | 519 | except KeyboardInterrupt: |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 520 | pass |
| 521 | |
| 522 | # header |
| 523 | print("\n%-25s %-25s %-20s %-10s" % ( |
| 524 | "LADDR", "RADDR", "RPORT", "CONNECTS")) |
| 525 | depict_cnt(b["ipv4_count"]) |
| 526 | depict_cnt(b["ipv6_count"], l3prot='ipv6') |
| 527 | # read events |
| 528 | else: |
| 529 | # header |
| 530 | if args.timestamp: |
| 531 | print("%-9s" % ("TIME(s)"), end="") |
| 532 | if args.print_uid: |
| 533 | print("%-6s" % ("UID"), end="") |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 534 | if args.lport: |
xingfeng2510 | 03e4948 | 2022-03-17 13:07:16 +0800 | [diff] [blame] | 535 | print("%-7s %-12s %-2s %-16s %-6s %-16s %-6s" % ("PID", "COMM", "IP", "SADDR", |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 536 | "LPORT", "DADDR", "DPORT"), end="") |
| 537 | else: |
xingfeng2510 | 03e4948 | 2022-03-17 13:07:16 +0800 | [diff] [blame] | 538 | print("%-7s %-12s %-2s %-16s %-16s %-6s" % ("PID", "COMM", "IP", "SADDR", |
suresh2514 | 57cd85d | 2021-03-12 09:35:14 +0530 | [diff] [blame] | 539 | "DADDR", "DPORT"), end="") |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 540 | if args.dns: |
| 541 | print(" QUERY") |
| 542 | else: |
| 543 | print() |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 544 | |
| 545 | start_ts = 0 |
| 546 | |
| 547 | # read events |
| 548 | b["ipv4_events"].open_perf_buffer(print_ipv4_event) |
| 549 | b["ipv6_events"].open_perf_buffer(print_ipv6_event) |
Nabil Schear | 33817e6 | 2020-10-07 21:58:07 -0700 | [diff] [blame] | 550 | if args.dns: |
| 551 | b["dns_events"].open_perf_buffer(save_dns) |
| 552 | while True: |
Xiaozhou Liu | 9518a5b | 2019-08-02 01:13:53 +0800 | [diff] [blame] | 553 | try: |
| 554 | b.perf_buffer_poll() |
| 555 | except KeyboardInterrupt: |
| 556 | exit() |