bpf_probe_read(&dport, sizeof(dport), &skp->__sk_common.skc_dport);
// output
- bpf_trace_printk("%x %x %d\\n", saddr, daddr, ntohs(dport));
+ bpf_trace_printk("trace_tcp4connect %x %x %d\\n", saddr, daddr, ntohs(dport));
currsock.delete(&pid);
addr = addr >> 8
return dq
-# format output
+# filter and format output
while 1:
- (task, pid, cpu, flags, ts, msg) = b.trace_fields()
- (saddr_hs, daddr_hs, dport_s) = msg.split(" ")
+ # Read messages from kernel pipe
+ try:
+ (task, pid, cpu, flags, ts, msg) = b.trace_fields()
+ (_tag, saddr_hs, daddr_hs, dport_s) = msg.split(" ")
+ except ValueError:
+ # Ignore messages from other tracers
+ continue
+
+ # Ignore messages from other tracers
+ if _tag != "trace_tcp4connect":
+ continue
print("%-6d %-12.12s %-16s %-16s %-4s" % (pid, task,
inet_ntoa(int(saddr_hs, 16)),