#define TCP_EVENT_TYPE_CLOSE 3
struct tcp_ipv4_event_t {
- u64 ts_us;
+ u64 ts_ns;
u32 type;
u32 pid;
char comm[TASK_COMM_LEN];
BPF_PERF_OUTPUT(tcp_ipv4_event);
struct tcp_ipv6_event_t {
- u64 ts_us;
+ u64 ts_ns;
u32 type;
u32 pid;
char comm[TASK_COMM_LEN];
}
struct tcp_ipv4_event_t evt4 = { };
- evt4.ts_us = bpf_ktime_get_ns() / 1000;
+ evt4.ts_ns = bpf_ktime_get_ns();
evt4.type = TCP_EVENT_TYPE_CONNECT;
evt4.pid = p->pid >> 32;
evt4.ip = ipver;
}
struct tcp_ipv6_event_t evt6 = { };
- evt6.ts_us = bpf_ktime_get_ns() / 1000;
+ evt6.ts_ns = bpf_ktime_get_ns();
evt6.type = TCP_EVENT_TYPE_CONNECT;
evt6.pid = p->pid >> 32;
evt6.ip = ipver;
}
struct tcp_ipv4_event_t evt4 = { };
- evt4.ts_us = bpf_ktime_get_ns() / 1000;
+ evt4.ts_ns = bpf_ktime_get_ns();
evt4.type = TCP_EVENT_TYPE_CLOSE;
evt4.pid = pid >> 32;
evt4.ip = ipver;
}
struct tcp_ipv6_event_t evt6 = { };
- evt6.ts_us = bpf_ktime_get_ns() / 1000;
+ evt6.ts_ns = bpf_ktime_get_ns();
evt6.type = TCP_EVENT_TYPE_CLOSE;
evt6.pid = pid >> 32;
evt6.ip = ipver;
struct tcp_ipv4_event_t evt4 = { 0 };
- evt4.ts_us = bpf_ktime_get_ns() / 1000;
+ evt4.ts_ns = bpf_ktime_get_ns();
evt4.type = TCP_EVENT_TYPE_ACCEPT;
evt4.netns = net_ns_inum;
evt4.pid = pid >> 32;
struct tcp_ipv6_event_t evt6 = { 0 };
- evt6.ts_us = bpf_ktime_get_ns() / 1000;
+ evt6.ts_ns = bpf_ktime_get_ns();
evt6.type = TCP_EVENT_TYPE_ACCEPT;
evt6.netns = net_ns_inum;
evt6.pid = pid >> 32;
class TCPIPV4Evt(ctypes.Structure):
_fields_ = [
- ("ts_us", ctypes.c_ulonglong),
+ ("ts_ns", ctypes.c_ulonglong),
("type", ctypes.c_uint),
("pid", ctypes.c_uint),
("comm", ctypes.c_char * TASK_COMM_LEN),
class TCPIPV6Evt(ctypes.Structure):
_fields_ = [
- ("ts_us", ctypes.c_ulonglong),
+ ("ts_ns", ctypes.c_ulonglong),
("type", ctypes.c_uint),
("pid", ctypes.c_uint),
("comm", ctypes.c_char * TASK_COMM_LEN),
def print_ipv4_event(cpu, data, size):
event = ctypes.cast(data, ctypes.POINTER(TCPIPV4Evt)).contents
global start_ts
+
if args.timestamp:
if start_ts == 0:
- start_ts = event.ts_us
- print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="")
+ start_ts = event.ts_ns
+ if args.verbose:
+ print("%-14d" % (event.ts_ns - start_ts), end="")
+ else:
+ print("%-9.3f" % ((float(event.ts_ns) - start_ts) / 1000000000), end="")
if event.type == 1:
type_str = "C"
elif event.type == 2:
global start_ts
if args.timestamp:
if start_ts == 0:
- start_ts = event.ts_us
- print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="")
+ start_ts = event.ts_ns
+ if args.verbose:
+ print("%-14d" % (event.ts_ns - start_ts), end="")
+ else:
+ print("%-9.3f" % ((float(event.ts_ns) - start_ts) / 1000000000), end="")
if event.type == 1:
type_str = "C"
elif event.type == 2:
print("Tracing TCP established connections. Ctrl-C to end.")
# header
-if args.timestamp:
- print("%-9s" % ("TIME(s)"), end="")
if args.verbose:
+ if args.timestamp:
+ print("%-14s" % ("TIME(ns)"), end="")
print("%-12s %-6s %-16s %-2s %-16s %-16s %-6s %-7s" % ("TYPE",
"PID", "COMM", "IP", "SADDR", "DADDR", "SPORT", "DPORT"), end="")
if not args.netns:
print("%-8s" % "NETNS", end="")
print()
else:
+ if args.timestamp:
+ print("%-9s" % ("TIME(s)"), end="")
print("%-2s %-6s %-16s %-2s %-16s %-16s %-6s %-6s" %
("T", "PID", "COMM", "IP", "SADDR", "DADDR", "SPORT", "DPORT"))