parser = ap.ArgumentParser(description="Trace TCP connections",
formatter_class=ap.RawDescriptionHelpFormatter)
+parser.add_argument("-t", "--timestamp", action="store_true",
+ help="include timestamp on output")
parser.add_argument("-p", "--pid", default=0, type=int,
help="trace this PID only")
parser.add_argument("-N", "--netns", default=0, type=int,
#define TCP_EVENT_TYPE_CLOSE 3
struct tcp_ipv4_event_t {
+ u64 ts_us;
u32 type;
u32 pid;
char comm[TASK_COMM_LEN];
BPF_PERF_OUTPUT(tcp_ipv4_event);
struct tcp_ipv6_event_t {
+ u64 ts_us;
u32 type;
u32 pid;
char comm[TASK_COMM_LEN];
}
struct tcp_ipv4_event_t evt4 = { };
+ evt4.ts_us = bpf_ktime_get_ns() / 1000;
evt4.type = TCP_EVENT_TYPE_CONNECT;
evt4.pid = p->pid >> 32;
evt4.ip = ipver;
}
struct tcp_ipv6_event_t evt6 = { };
+ evt6.ts_us = bpf_ktime_get_ns() / 1000;
evt6.type = TCP_EVENT_TYPE_CONNECT;
evt6.pid = p->pid >> 32;
evt6.ip = ipver;
}
struct tcp_ipv4_event_t evt4 = { };
+ evt4.ts_us = bpf_ktime_get_ns() / 1000;
evt4.type = TCP_EVENT_TYPE_CLOSE;
evt4.pid = pid >> 32;
evt4.ip = ipver;
}
struct tcp_ipv6_event_t evt6 = { };
+ evt6.ts_us = bpf_ktime_get_ns() / 1000;
evt6.type = TCP_EVENT_TYPE_CLOSE;
evt6.pid = pid >> 32;
evt6.ip = ipver;
struct tcp_ipv4_event_t evt4 = { 0 };
+ evt4.ts_us = bpf_ktime_get_ns() / 1000;
evt4.type = TCP_EVENT_TYPE_ACCEPT;
evt4.netns = net_ns_inum;
evt4.pid = pid >> 32;
struct tcp_ipv6_event_t evt6 = { 0 };
+ evt6.ts_us = bpf_ktime_get_ns() / 1000;
evt6.type = TCP_EVENT_TYPE_ACCEPT;
evt6.netns = net_ns_inum;
evt6.pid = pid >> 32;
class TCPIPV4Evt(ctypes.Structure):
_fields_ = [
+ ("ts_us", ctypes.c_ulonglong),
("type", ctypes.c_uint),
("pid", ctypes.c_uint),
("comm", ctypes.c_char * TASK_COMM_LEN),
class TCPIPV6Evt(ctypes.Structure):
_fields_ = [
+ ("ts_us", ctypes.c_ulonglong),
("type", ctypes.c_uint),
("pid", ctypes.c_uint),
("comm", ctypes.c_char * TASK_COMM_LEN),
def print_ipv4_event(cpu, data, size):
event = ctypes.cast(data, ctypes.POINTER(TCPIPV4Evt)).contents
+ global start_ts
+ if args.timestamp:
+ if start_ts == 0:
+ start_ts = event.ts_us
+ print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="")
if event.type == 1:
type_str = "C"
elif event.type == 2:
def print_ipv6_event(cpu, data, size):
event = ctypes.cast(data, ctypes.POINTER(TCPIPV6Evt)).contents
+ global start_ts
+ if args.timestamp:
+ if start_ts == 0:
+ start_ts = event.ts_us
+ print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="")
if event.type == 1:
type_str = "C"
elif event.type == 2:
print("Tracing TCP established connections. Ctrl-C to end.")
# header
+if args.timestamp:
+ print("%-9s" % ("TIME(s)"), end="")
if args.verbose:
print("%-12s %-6s %-16s %-2s %-16s %-16s %-6s %-7s" % ("TYPE",
"PID", "COMM", "IP", "SADDR", "DADDR", "SPORT", "DPORT"), end="")
print("%-2s %-6s %-16s %-2s %-16s %-16s %-6s %-6s" %
("T", "PID", "COMM", "IP", "SADDR", "DADDR", "SPORT", "DPORT"))
+start_ts = 0
def inet_ntoa(addr):
dq = ''