cddl/contrib/dtracetoolkit/Net/tcpsnoop_snv.d

   1 #!/usr/sbin/dtrace -Cs
   2 /*
   3  * tcpsnoop_snv.d - snoop TCP network packets by process.
   4  *                  Written using DTrace (Solaris Nevada)
   5  *
   6  * This analyses TCP network packets and prints the responsible PID and UID,
   7  * plus standard details such as IP address and port. This captures traffic
   8  * of newly created TCP connections that were established while this program
   9  * was running. It can help identify which processes is causing TCP traffic.
  10  *
  11  * WARNING: This script may only work on Solaris Nevada and OpenSolaris
  12  * of the late 2007 vintage, since it uses the fbt provider to trace the raw
  13  * operation of a specific version of the kernel. In the future, a 'stable'
  14  * network provider should exist which will allow this to be written for that
  15  * and subsequent versions of the kernel. In the meantime, check for other
  16  * versions of this script in the /Net directory, and read the
  17  * Notes/ALLfbt_notes.txt for more background on fbt.
  18  *
  19  * $Id: tcpsnoop_snv.d 69 2007-10-04 13:40:00Z brendan $
  20  *
  21  * USAGE:       tcpsnoop.d
  22  *
  23  * FIELDS:
  24  *              UID             user ID
  25  *              PID             process ID
  26  *              CMD             command
  27  *              LADDR           local IP address
  28  *              RADDR           remote IP address
  29  *              LPORT           local port number
  30  *              RPORT           remote port number
  31  *              DR              direction
  32  *              SIZE            packet size, bytes
  33  *
  34  * SEE ALSO: snoop -rS
  35  *
  36  * COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg.
  37  *
  38  * CDDL HEADER START
  39  *
  40  *  The contents of this file are subject to the terms of the
  41  *  Common Development and Distribution License, Version 1.0 only
  42  *  (the "License").  You may not use this file except in compliance
  43  *  with the License.
  44  *
  45  *  You can obtain a copy of the license at Docs/cddl1.txt
  46  *  or http://www.opensolaris.org/os/licensing.
  47  *  See the License for the specific language governing permissions
  48  *  and limitations under the License.
  49  *
  50  * CDDL HEADER END
  51  *
  52  * Author: Brendan Gregg  [Sydney, Australia]
  53  *
  54  * TODO: IPv6
  55  *
  56  * 09-Jul-2004  Brendan Gregg   Created this.
  57  * 12-Mar-2005     "      "     Changed probes, size info now printed.
  58  * 02-Jul-2005     "      "     Many more probes. Renamed "tcpsnoop.d".
  59  * 03-Dec-2005     "      "     Fixed tcp_accept_finish bug, now 100% correct
  60  *                              execname. Thanks Kias Belgaied for expertise.
  61  * 20-Apr-2006     "      "     Fixed SS_TCP_FAST_ACCEPT bug in build 31+.
  62  * 20-Apr-2006     "      "     Last update.
  63  * 30-Sep-2007     "      "     Bumped this for recent OpenSolaris/Nevada.
  64  */
  65
  66 #pragma D option quiet
  67 #pragma D option switchrate=10hz
  68
  69 #include <sys/file.h>
  70 #include <inet/common.h>
  71 #include <sys/byteorder.h>
  72
  73 /*
  74  * Print header
  75  */
  76 dtrace:::BEGIN
  77 {
  78         /* print main headers */
  79         printf("%5s %6s %-15s %5s %2s %-15s %5s %5s %s\n",
  80             "UID", "PID", "LADDR", "LPORT", "DR", "RADDR", "RPORT",
  81             "SIZE", "CMD");
  82 }
  83
  84 /*
  85  * TCP Process inbound connections
  86  *
  87  * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was
  88  * renamed to SS_DIRECT around build 31.
  89  */
  90 fbt:sockfs:sotpi_accept:entry
  91 /(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/
  92 {
  93         self->sop = args[0];
  94 }
  95
  96 fbt:sockfs:sotpi_create:return
  97 /self->sop/
  98 {
  99         self->nsop = (struct sonode *)arg1;
 100 }
 101
 102 fbt:sockfs:sotpi_accept:return
 103 /self->nsop/
 104 {
 105         this->tcpp = (tcp_t *)self->nsop->so_priv;
 106         self->connp = (conn_t *)this->tcpp->tcp_connp;
 107         tname[(int)self->connp] = execname;
 108         tpid[(int)self->connp] = pid;
 109         tuid[(int)self->connp] = uid;
 110 }
 111
 112 fbt:sockfs:sotpi_accept:return
 113 {
 114         self->nsop = 0;
 115         self->sop = 0;
 116 }
 117
 118 /*
 119  * TCP Process outbound connections
 120  */
 121 fbt:ip:tcp_connect:entry
 122 {
 123         this->tcpp = (tcp_t *)arg0;
 124         self->connp = (conn_t *)this->tcpp->tcp_connp;
 125         tname[(int)self->connp] = execname;
 126         tpid[(int)self->connp] = pid;
 127         tuid[(int)self->connp] = uid;
 128 }
 129
 130 /*
 131  * TCP Data translations
 132  */
 133 fbt:sockfs:sotpi_accept:return,
 134 fbt:ip:tcp_connect:return
 135 /self->connp/
 136 {
 137         /* fetch ports */
 138 #if defined(_BIG_ENDIAN)
 139         self->lport = self->connp->u_port.tcpu_ports.tcpu_lport;
 140         self->fport = self->connp->u_port.tcpu_ports.tcpu_fport;
 141 #else
 142         self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport);
 143         self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport);
 144 #endif
 145
 146         /* fetch IPv4 addresses */
 147         this->fad12 =
 148             (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12];
 149         this->fad13 =
 150             (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13];
 151         this->fad14 =
 152             (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14];
 153         this->fad15 =
 154             (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15];
 155         this->lad12 =
 156             (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12];
 157         this->lad13 =
 158             (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13];
 159         this->lad14 =
 160             (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14];
 161         this->lad15 =
 162             (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15];
 163
 164         /* convert type for use with lltostr() */
 165         this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12;
 166         this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13;
 167         this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14;
 168         this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15;
 169         this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12;
 170         this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13;
 171         this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14;
 172         this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15;
 173
 174         /* stringify addresses */
 175         self->faddr = strjoin(lltostr(this->fad12), ".");
 176         self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
 177         self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
 178         self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
 179         self->laddr = strjoin(lltostr(this->lad12), ".");
 180         self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
 181         self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
 182         self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
 183
 184         /* fix direction and save values */
 185         tladdr[(int)self->connp] = self->laddr;
 186         tfaddr[(int)self->connp] = self->faddr;
 187         tlport[(int)self->connp] = self->lport;
 188         tfport[(int)self->connp] = self->fport;
 189
 190         /* all systems go */
 191         tok[(int)self->connp] = 1;
 192 }
 193
 194 /*
 195  * TCP Clear connp
 196  */
 197 fbt:ip:tcp_get_conn:return
 198 {
 199         /* Q_TO_CONN */
 200         this->connp = (conn_t *)arg1;
 201         tok[(int)this->connp] = 0;
 202         tpid[(int)this->connp] = 0;
 203         tuid[(int)this->connp] = 0;
 204         tname[(int)this->connp] = 0;
 205 }
 206
 207 /*
 208  * TCP Process "port closed"
 209  */
 210 fbt:ip:tcp_xmit_early_reset:entry
 211 {
 212         this->queuep = args[7]->tcps_g_q;
 213         this->connp = (conn_t *)this->queuep->q_ptr;
 214         this->tcpp = (tcp_t *)this->connp->conn_tcp;
 215
 216         /* split addresses */
 217         this->ipha = (ipha_t *)args[1]->b_rptr;
 218         this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24;
 219         this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16;
 220         this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8;
 221         this->fad12 = (this->ipha->ipha_src & 0x000000ff);
 222         this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24;
 223         this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16;
 224         this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8;
 225         this->lad12 = (this->ipha->ipha_dst & 0x000000ff);
 226
 227         /* stringify addresses */
 228         self->faddr = strjoin(lltostr(this->fad12), ".");
 229         self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
 230         self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
 231         self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
 232         self->laddr = strjoin(lltostr(this->lad12), ".");
 233         self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
 234         self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
 235         self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
 236
 237         self->reset = 1;
 238 }
 239
 240 /*
 241  * TCP Fetch "port closed" ports
 242  */
 243 fbt:ip:tcp_xchg:entry
 244 /self->reset/
 245 {
 246 #if defined(_BIG_ENDIAN)
 247         self->lport = (uint16_t)arg0;
 248         self->fport = (uint16_t)arg1;
 249 #else
 250         self->lport = BSWAP_16((uint16_t)arg0);
 251         self->fport = BSWAP_16((uint16_t)arg1);
 252 #endif
 253         self->lport = BE16_TO_U16(arg0);
 254         self->fport = BE16_TO_U16(arg1);
 255 }
 256
 257 /*
 258  * TCP Print "port closed"
 259  */
 260 fbt:ip:tcp_xmit_early_reset:return
 261 {
 262         self->name = "<closed>";
 263         self->pid = 0;
 264         self->uid = 0;
 265         self->size = 54;        /* should check trailers */
 266         self->dir = "<-";
 267         printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
 268             self->uid, self->pid, self->laddr, self->lport, self->dir,
 269             self->faddr, self->fport, self->size, self->name);
 270         self->dir = "->";
 271         printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
 272             self->uid, self->pid, self->laddr, self->lport, self->dir,
 273             self->faddr, self->fport, self->size, self->name);
 274         self->reset = 0;
 275         self->size = 0;
 276         self->name = 0;
 277 }
 278
 279 /*
 280  * TCP Process Write
 281  */
 282 fbt:ip:tcp_send_data:entry
 283 {
 284         self->conn_p = (conn_t *)args[0]->tcp_connp;
 285 }
 286
 287 fbt:ip:tcp_send_data:entry
 288 /tok[(int)self->conn_p]/
 289 {
 290         self->dir = "->";
 291         self->size = msgdsize(args[2]) + 14;    /* should check trailers */
 292         self->uid = tuid[(int)self->conn_p];
 293         self->laddr = tladdr[(int)self->conn_p];
 294         self->faddr = tfaddr[(int)self->conn_p];
 295         self->lport = tlport[(int)self->conn_p];
 296         self->fport = tfport[(int)self->conn_p];
 297         self->ok = 2;
 298
 299         /* follow inetd -> in.* transitions */
 300         self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
 301             execname : tname[(int)self->conn_p];
 302         self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
 303             pid : tpid[(int)self->conn_p];
 304         tname[(int)self->conn_p] = self->name;
 305         tpid[(int)self->conn_p] = self->pid;
 306 }
 307
 308 /*
 309  * TCP Process Read
 310  */
 311 fbt:ip:tcp_rput_data:entry
 312 {
 313         self->conn_p = (conn_t *)arg0;
 314         self->size = msgdsize(args[1]) + 14;    /* should check trailers */
 315 }
 316
 317 fbt:ip:tcp_rput_data:entry
 318 /tok[(int)self->conn_p]/
 319 {
 320         self->dir = "<-";
 321         self->uid = tuid[(int)self->conn_p];
 322         self->laddr = tladdr[(int)self->conn_p];
 323         self->faddr = tfaddr[(int)self->conn_p];
 324         self->lport = tlport[(int)self->conn_p];
 325         self->fport = tfport[(int)self->conn_p];
 326         self->ok = 2;
 327
 328         /* follow inetd -> in.* transitions */
 329         self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
 330             execname : tname[(int)self->conn_p];
 331         self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
 332             pid : tpid[(int)self->conn_p];
 333         tname[(int)self->conn_p] = self->name;
 334         tpid[(int)self->conn_p] = self->pid;
 335 }
 336
 337 /*
 338  * TCP Complete printing outbound handshake
 339  */
 340 fbt:ip:tcp_connect:return
 341 /self->connp/
 342 {
 343         self->name = tname[(int)self->connp];
 344         self->pid = tpid[(int)self->connp];
 345         self->uid = tuid[(int)self->connp];
 346         self->size = 54;        /* should check trailers */
 347         self->dir = "->";
 348         /* this packet occured before connp was fully established */
 349         printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
 350             self->uid, self->pid, self->laddr, self->lport, self->dir,
 351             self->faddr, self->fport, self->size, self->name);
 352 }
 353
 354 /*
 355  * TCP Complete printing inbound handshake
 356  */
 357 fbt:sockfs:sotpi_accept:return
 358 /self->connp/
 359 {
 360         self->name = tname[(int)self->connp];
 361         self->pid = tpid[(int)self->connp];
 362         self->uid = tuid[(int)self->connp];
 363         self->size = 54;        /* should check trailers */
 364         /* these packets occured before connp was fully established */
 365         self->dir = "<-";
 366         printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
 367             self->uid, self->pid, self->laddr, self->lport, self->dir,
 368             self->faddr, self->fport, self->size, self->name);
 369         self->dir = "->";
 370         printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
 371             self->uid, self->pid, self->laddr, self->lport, self->dir,
 372             self->faddr, self->fport, self->size, self->name);
 373         self->dir = "<-";
 374         printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
 375             self->uid, self->pid, self->laddr, self->lport, self->dir,
 376             self->faddr, self->fport, self->size, self->name);
 377 }
 378
 379 /*
 380  * Print output
 381  */
 382 fbt:ip:tcp_send_data:entry,
 383 fbt:ip:tcp_rput_data:entry
 384 /self->ok == 2/
 385 {
 386         /* print output line */
 387         printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
 388             self->uid, self->pid, self->laddr, self->lport, self->dir,
 389             self->faddr, self->fport, self->size, self->name);
 390 }
 391
 392 /*
 393  * TCP Clear connect variables
 394  */
 395 fbt:sockfs:sotpi_accept:return,
 396 fbt:ip:tcp_connect:return
 397 /self->connp/
 398 {
 399         self->faddr = 0;
 400         self->laddr = 0;
 401         self->fport = 0;
 402         self->lport = 0;
 403         self->connp = 0;
 404         self->name = 0;
 405         self->pid = 0;
 406         self->uid = 0;
 407 }
 408
 409 /*
 410  * TCP Clear r/w variables
 411  */
 412 fbt:ip:tcp_send_data:entry,
 413 fbt:ip:tcp_rput_data:entry
 414 {
 415         self->ok = 0;
 416         self->dir = 0;
 417         self->uid = 0;
 418         self->pid = 0;
 419         self->size = 0;
 420         self->name = 0;
 421         self->lport = 0;
 422         self->fport = 0;
 423         self->laddr = 0;
 424         self->faddr = 0;
 425         self->conn_p = 0;
 426 }