3 # tcptop - display top TCP network packets by process.
4 # Written using DTrace (Solaris 10 3/05)
6 # This analyses TCP network packets and prints the responsible PID and UID,
7 # plus standard details such as IP address and port. This captures traffic
8 # of newly created TCP connections that were established while this program
9 # was running. It can help identify which processes is causing TCP traffic.
11 # WARNING: This script may only work on Solaris 10 3/05, since it uses the
12 # fbt provider to trace the raw operation of a specific version of the kernel.
13 # In the future, a 'stable' network provider should exist which will allow
14 # this to be written for that and subsequent versions of the kernel. In the
15 # meantime, check for other versions of this script in the /Net directory,
16 # and read the Notes/ALLfbt_notes.txt for more background on fbt.
18 # $Id: tcptop 69 2007-10-04 13:40:00Z brendan $
20 # USAGE: tcptop [-Ch] [-j|-Z] [interval [count]]
22 # -C # don't clear the screen
23 # -j # print project IDs
30 # LADDR local IP address
31 # RADDR remote IP address
32 # LPORT local port number
33 # RPORT remote port number
34 # SIZE packet size, bytes
35 # load 1 min load average
36 # TCPin TCP inbound payload data
37 # TCPout TCP outbound payload data
43 # COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg.
47 # The contents of this file are subject to the terms of the
48 # Common Development and Distribution License, Version 1.0 only
49 # (the "License"). You may not use this file except in compliance
52 # You can obtain a copy of the license at Docs/cddl1.txt
53 # or http://www.opensolaris.org/os/licensing.
54 # See the License for the specific language governing permissions
55 # and limitations under the License.
59 # Author: Brendan Gregg [Sydney, Australia]
63 # 05-Jul-2005 Brendan Gregg Created this.
64 # 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct
65 # execname. Thanks Kias Belgaied for expertise.
66 # 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+.
67 # 20-Apr-2006 " " Last update.
70 ##############################
71 # --- Process Arguments ---
75 opt_def=1; opt_clear=1; opt_zone=0; opt_proj=0; interval=5; count=-1
78 while getopts ChjZ name
82 j) opt_proj=1; opt_def=0 ;;
83 Z) opt_zone=1; opt_def=0 ;;
85 USAGE: tcptop [-h] [-j|-Z] [interval [count]]
86 tcptop # default output
87 -C # don't clear the screen
91 tcptop # default is 5 sec interval
92 tcptop 2 # 2 second interval
93 tcptop -C 1 10 # 10 x 1 sec samples, no clear
98 shift $(( $OPTIND - 1 ))
101 if [[ "$1" > 0 ]]; then
104 if [[ "$1" > 0 ]]; then
107 if (( opt_proj && opt_zone )); then
110 if (( opt_clear )); then
116 #################################
117 # --- Main Program, DTrace ---
119 /usr/sbin/dtrace -Cs <( print -r '
121 * Command line arguments
123 inline int OPT_def = '$opt_def';
124 inline int OPT_zone = '$opt_zone';
125 inline int OPT_proj = '$opt_proj';
126 inline int OPT_clear = '$opt_clear';
127 inline int INTERVAL = '$interval';
128 inline int COUNTER = '$count';
129 inline string CLEAR = "'$clearstr'";
131 #pragma D option quiet
132 #pragma D option switchrate=10hz
134 #include <sys/file.h>
135 #include <inet/common.h>
136 #include <sys/byteorder.h>
137 #include <sys/socket.h>
138 #include <sys/socketvar.h>
145 /* starting values */
151 printf("Tracing... Please wait.\n");
155 * TCP Process inbound connections
157 * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was
158 * renamed to SS_DIRECT around build 31.
160 fbt:sockfs:sotpi_accept:entry
161 /(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/
166 fbt:sockfs:sotpi_create:return
169 self->nsop = (struct sonode *)arg1;
172 fbt:sockfs:sotpi_accept:return
175 this->tcpp = (tcp_t *)self->nsop->so_priv;
176 self->connp = (conn_t *)this->tcpp->tcp_connp;
177 tname[(int)self->connp] = execname;
178 tpid[(int)self->connp] = pid;
179 tuid[(int)self->connp] = uid;
182 fbt:sockfs:sotpi_accept:return
189 * TCP Process outbound connections
191 fbt:ip:tcp_connect:entry
193 this->tcpp = (tcp_t *)arg0;
194 self->connp = (conn_t *)this->tcpp->tcp_connp;
195 tname[(int)self->connp] = execname;
196 tpid[(int)self->connp] = pid;
197 tuid[(int)self->connp] = uid;
198 OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1;
202 * TCP Data translations
204 fbt:sockfs:sotpi_accept:return,
205 fbt:ip:tcp_connect:return
209 #if defined(_BIG_ENDIAN)
210 self->lport = self->connp->u_port.tcpu_ports.tcpu_lport;
211 self->fport = self->connp->u_port.tcpu_ports.tcpu_fport;
213 self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport);
214 self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport);
217 /* fetch IPv4 addresses */
219 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12];
221 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13];
223 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14];
225 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15];
227 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12];
229 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13];
231 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14];
233 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15];
235 /* convert type for use with lltostr() */
236 this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12;
237 this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13;
238 this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14;
239 this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15;
240 this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12;
241 this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13;
242 this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14;
243 this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15;
245 /* stringify addresses */
246 self->faddr = strjoin(lltostr(this->fad12), ".");
247 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
248 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
249 self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
250 self->laddr = strjoin(lltostr(this->lad12), ".");
251 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
252 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
253 self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
255 /* fix direction and save values */
256 tladdr[(int)self->connp] = self->laddr;
257 tfaddr[(int)self->connp] = self->faddr;
258 tlport[(int)self->connp] = self->lport;
259 tfport[(int)self->connp] = self->fport;
262 tok[(int)self->connp] = 1;
268 fbt:ip:tcp_get_conn:return
271 this->connp = (conn_t *)arg1;
272 tok[(int)this->connp] = 0;
273 tpid[(int)this->connp] = 0;
274 tuid[(int)this->connp] = 0;
275 tname[(int)this->connp] = 0;
276 tproj[(int)this->connp] = 0;
280 * TCP Process "port closed"
282 fbt:ip:tcp_xmit_early_reset:entry
284 this->queuep = (queue_t *)`tcp_g_q; /* ` */
285 this->connp = (conn_t *)this->queuep->q_ptr;
286 this->tcpp = (tcp_t *)this->connp->conn_tcp;
287 self->zoneid = this->connp->conn_zoneid;
289 /* split addresses */
290 this->ipha = (ipha_t *)args[1]->b_rptr;
291 this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24;
292 this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16;
293 this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8;
294 this->fad12 = (this->ipha->ipha_src & 0x000000ff);
295 this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24;
296 this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16;
297 this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8;
298 this->lad12 = (this->ipha->ipha_dst & 0x000000ff);
300 /* stringify addresses */
301 self->faddr = strjoin(lltostr(this->fad12), ".");
302 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
303 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
304 self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
305 self->laddr = strjoin(lltostr(this->lad12), ".");
306 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
307 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
308 self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
314 * TCP Fetch "port closed" ports
316 fbt:ip:tcp_xchg:entry
319 #if defined(_BIG_ENDIAN)
320 self->lport = (uint16_t)arg0;
321 self->fport = (uint16_t)arg1;
323 self->lport = BSWAP_16((uint16_t)arg0);
324 self->fport = BSWAP_16((uint16_t)arg1);
326 self->lport = BE16_TO_U16(arg0);
327 self->fport = BE16_TO_U16(arg1);
331 * TCP Print "port closed"
333 fbt:ip:tcp_xmit_early_reset:return
335 self->name = "<closed>";
339 self->size = 54 * 2; /* should check trailers */
340 OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport,
341 self->faddr, self->fport, self->name] = sum(self->size) : 1;
342 OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport,
343 self->faddr, self->fport, self->name] = sum(self->size) : 1;
344 OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport,
345 self->faddr, self->fport, self->name] = sum(self->size) : 1;
354 fbt:ip:tcp_send_data:entry
356 self->conn_p = (conn_t *)args[0]->tcp_connp;
359 fbt:ip:tcp_send_data:entry
360 /tok[(int)self->conn_p]/
362 self->size = msgdsize(args[2]) + 14; /* should check trailers */
363 self->uid = tuid[(int)self->conn_p];
364 self->laddr = tladdr[(int)self->conn_p];
365 self->faddr = tfaddr[(int)self->conn_p];
366 self->lport = tlport[(int)self->conn_p];
367 self->fport = tfport[(int)self->conn_p];
368 OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1;
369 self->zoneid = self->conn_p->conn_zoneid;
372 /* follow inetd -> in.* transitions */
373 self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
374 execname : tname[(int)self->conn_p];
375 self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
376 pid : tpid[(int)self->conn_p];
377 tname[(int)self->conn_p] = self->name;
378 tpid[(int)self->conn_p] = self->pid;
384 fbt:ip:tcp_rput_data:entry
386 self->conn_p = (conn_t *)arg0;
387 self->size = msgdsize(args[1]) + 14; /* should check trailers */
390 fbt:ip:tcp_rput_data:entry
391 /tok[(int)self->conn_p]/
393 self->uid = tuid[(int)self->conn_p];
394 self->laddr = tladdr[(int)self->conn_p];
395 self->faddr = tfaddr[(int)self->conn_p];
396 self->lport = tlport[(int)self->conn_p];
397 self->fport = tfport[(int)self->conn_p];
398 OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1;
399 self->zoneid = self->conn_p->conn_zoneid;
402 /* follow inetd -> in.* transitions */
403 self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
404 execname : tname[(int)self->conn_p];
405 self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
406 pid : tpid[(int)self->conn_p];
407 tname[(int)self->conn_p] = self->name;
408 tpid[(int)self->conn_p] = self->pid;
412 * TCP Complete printing outbound handshake
414 fbt:ip:tcp_connect:return
417 self->name = tname[(int)self->connp];
418 self->pid = tpid[(int)self->connp];
419 self->uid = tuid[(int)self->connp];
420 self->zoneid = self->connp->conn_zoneid;
421 OPT_proj ? self->proj = tproj[(int)self->connp] : 1;
422 self->size = 54; /* should check trailers */
424 /* this packet occured before connp was fully established */
425 OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport,
426 self->faddr, self->fport, self->name] = sum(self->size) : 1;
427 OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport,
428 self->faddr, self->fport, self->name] = sum(self->size) : 1;
429 OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport,
430 self->faddr, self->fport, self->name] = sum(self->size) : 1;
434 * TCP Complete printing inbound handshake
436 fbt:sockfs:sotpi_accept:return
439 self->name = tname[(int)self->connp];
440 self->pid = tpid[(int)self->connp];
441 self->uid = tuid[(int)self->connp];
442 self->zoneid = self->connp->conn_zoneid;
443 OPT_proj ? self->proj = tproj[(int)self->connp] : 1;
444 self->size = 54 * 3; /* should check trailers */
446 /* these packets occured before connp was fully established */
447 OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport,
448 self->faddr, self->fport, self->name] = sum(self->size) : 1;
449 OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport,
450 self->faddr, self->fport, self->name] = sum(self->size) : 1;
451 OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport,
452 self->faddr, self->fport, self->name] = sum(self->size) : 1;
458 fbt:ip:tcp_send_data:entry,
459 fbt:ip:tcp_rput_data:entry
463 OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport,
464 self->faddr, self->fport, self->name] = sum(self->size) : 1;
465 OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport,
466 self->faddr, self->fport, self->name] = sum(self->size) : 1;
467 OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport,
468 self->faddr, self->fport, self->name] = sum(self->size) : 1;
472 * TCP Clear connect variables
474 fbt:sockfs:sotpi_accept:return,
475 fbt:ip:tcp_connect:return
489 * TCP Clear r/w variables
491 fbt:ip:tcp_send_data:entry,
492 fbt:ip:tcp_rput_data:entry
509 * TCP Systemwide Stats
511 mib:::tcpOutDataBytes { TCP_out += args[0]; }
512 mib:::tcpRetransBytes { TCP_out += args[0]; }
513 mib:::tcpInDataInorderBytes { TCP_in += args[0]; }
514 mib:::tcpInDataDupBytes { TCP_in += args[0]; }
515 mib:::tcpInDataUnorderBytes { TCP_in += args[0]; }
531 /* fetch 1 min load average */
532 this->load1a = `hp_avenrun[0] / 65536;
533 this->load1b = ((`hp_avenrun[0] % 65536) * 100) / 65536;
535 /* convert TCP counters to Kbytes */
540 OPT_clear ? printf("%s", CLEAR) : 1;
541 printf("%Y, load: %d.%02d, TCPin: %6d KB, TCPout: %6d KB\n\n",
542 walltimestamp, this->load1a, this->load1b, TCP_in, TCP_out);
545 OPT_def ? printf(" UID ") : 1;
546 OPT_proj ? printf("PROJ ") : 1;
547 OPT_zone ? printf("ZONE ") : 1;
548 printf("%6s %-15s %5s %-15s %5s %9s %s\n",
549 "PID", "LADDR", "LPORT", "RADDR", "RPORT", "SIZE", "NAME");
552 printa("%4d %6d %-15s %5d %-15s %5d %@9d %s\n", @out);