3 * tcpsnoop.d - snoop TCP network packets by process.
4 * Written using DTrace (Solaris 10 3/05)
6 * This analyses TCP network packets and prints the responsible PID and UID,
7 * plus standard details such as IP address and port. This captures traffic
8 * of newly created TCP connections that were established while this program
9 * was running. It can help identify which processes is causing TCP traffic.
11 * WARNING: This script may only work on Solaris 10 3/05, since it uses the
12 * fbt provider to trace the raw operation of a specific version of the kernel.
13 * In the future, a 'stable' network provider should exist which will allow
14 * this to be written for that and subsequent versions of the kernel. In the
15 * meantime, check for other versions of this script in the /Net directory,
16 * and read the Notes/ALLfbt_notes.txt for more background on fbt.
18 * $Id: tcpsnoop.d 69 2007-10-04 13:40:00Z brendan $
26 * LADDR local IP address
27 * RADDR remote IP address
28 * LPORT local port number
29 * RPORT remote port number
31 * SIZE packet size, bytes
35 * COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg.
39 * The contents of this file are subject to the terms of the
40 * Common Development and Distribution License, Version 1.0 only
41 * (the "License"). You may not use this file except in compliance
44 * You can obtain a copy of the license at Docs/cddl1.txt
45 * or http://www.opensolaris.org/os/licensing.
46 * See the License for the specific language governing permissions
47 * and limitations under the License.
51 * Author: Brendan Gregg [Sydney, Australia]
55 * 09-Jul-2004 Brendan Gregg Created this.
56 * 12-Mar-2005 " " Changed probes, size info now printed.
57 * 02-Jul-2005 " " Many more probes. Renamed "tcpsnoop.d".
58 * 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct
59 * execname. Thanks Kias Belgaied for expertise.
60 * 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+.
61 * 20-Apr-2006 " " Last update.
64 #pragma D option quiet
65 #pragma D option switchrate=10hz
68 #include <inet/common.h>
69 #include <sys/byteorder.h>
76 /* print main headers */
77 printf("%5s %6s %-15s %5s %2s %-15s %5s %5s %s\n",
78 "UID", "PID", "LADDR", "LPORT", "DR", "RADDR", "RPORT",
83 * TCP Process inbound connections
85 * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was
86 * renamed to SS_DIRECT around build 31.
88 fbt:sockfs:sotpi_accept:entry
89 /(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/
94 fbt:sockfs:sotpi_create:return
97 self->nsop = (struct sonode *)arg1;
100 fbt:sockfs:sotpi_accept:return
103 this->tcpp = (tcp_t *)self->nsop->so_priv;
104 self->connp = (conn_t *)this->tcpp->tcp_connp;
105 tname[(int)self->connp] = execname;
106 tpid[(int)self->connp] = pid;
107 tuid[(int)self->connp] = uid;
110 fbt:sockfs:sotpi_accept:return
117 * TCP Process outbound connections
119 fbt:ip:tcp_connect:entry
121 this->tcpp = (tcp_t *)arg0;
122 self->connp = (conn_t *)this->tcpp->tcp_connp;
123 tname[(int)self->connp] = execname;
124 tpid[(int)self->connp] = pid;
125 tuid[(int)self->connp] = uid;
129 * TCP Data translations
131 fbt:sockfs:sotpi_accept:return,
132 fbt:ip:tcp_connect:return
136 #if defined(_BIG_ENDIAN)
137 self->lport = self->connp->u_port.tcpu_ports.tcpu_lport;
138 self->fport = self->connp->u_port.tcpu_ports.tcpu_fport;
140 self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport);
141 self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport);
144 /* fetch IPv4 addresses */
146 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12];
148 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13];
150 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14];
152 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15];
154 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12];
156 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13];
158 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14];
160 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15];
162 /* convert type for use with lltostr() */
163 this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12;
164 this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13;
165 this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14;
166 this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15;
167 this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12;
168 this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13;
169 this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14;
170 this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15;
172 /* stringify addresses */
173 self->faddr = strjoin(lltostr(this->fad12), ".");
174 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
175 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
176 self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
177 self->laddr = strjoin(lltostr(this->lad12), ".");
178 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
179 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
180 self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
182 /* fix direction and save values */
183 tladdr[(int)self->connp] = self->laddr;
184 tfaddr[(int)self->connp] = self->faddr;
185 tlport[(int)self->connp] = self->lport;
186 tfport[(int)self->connp] = self->fport;
189 tok[(int)self->connp] = 1;
195 fbt:ip:tcp_get_conn:return
198 this->connp = (conn_t *)arg1;
199 tok[(int)this->connp] = 0;
200 tpid[(int)this->connp] = 0;
201 tuid[(int)this->connp] = 0;
202 tname[(int)this->connp] = 0;
206 * TCP Process "port closed"
208 fbt:ip:tcp_xmit_early_reset:entry
210 this->queuep = (queue_t *)`tcp_g_q; /* ` */
211 this->connp = (conn_t *)this->queuep->q_ptr;
212 this->tcpp = (tcp_t *)this->connp->conn_tcp;
214 /* split addresses */
215 this->ipha = (ipha_t *)args[1]->b_rptr;
216 this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24;
217 this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16;
218 this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8;
219 this->fad12 = (this->ipha->ipha_src & 0x000000ff);
220 this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24;
221 this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16;
222 this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8;
223 this->lad12 = (this->ipha->ipha_dst & 0x000000ff);
225 /* stringify addresses */
226 self->faddr = strjoin(lltostr(this->fad12), ".");
227 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
228 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
229 self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
230 self->laddr = strjoin(lltostr(this->lad12), ".");
231 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
232 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
233 self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
239 * TCP Fetch "port closed" ports
241 fbt:ip:tcp_xchg:entry
244 #if defined(_BIG_ENDIAN)
245 self->lport = (uint16_t)arg0;
246 self->fport = (uint16_t)arg1;
248 self->lport = BSWAP_16((uint16_t)arg0);
249 self->fport = BSWAP_16((uint16_t)arg1);
251 self->lport = BE16_TO_U16(arg0);
252 self->fport = BE16_TO_U16(arg1);
256 * TCP Print "port closed"
258 fbt:ip:tcp_xmit_early_reset:return
260 self->name = "<closed>";
263 self->size = 54; /* should check trailers */
265 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
266 self->uid, self->pid, self->laddr, self->lport, self->dir,
267 self->faddr, self->fport, self->size, self->name);
269 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
270 self->uid, self->pid, self->laddr, self->lport, self->dir,
271 self->faddr, self->fport, self->size, self->name);
280 fbt:ip:tcp_send_data:entry
282 self->conn_p = (conn_t *)args[0]->tcp_connp;
285 fbt:ip:tcp_send_data:entry
286 /tok[(int)self->conn_p]/
289 self->size = msgdsize(args[2]) + 14; /* should check trailers */
290 self->uid = tuid[(int)self->conn_p];
291 self->laddr = tladdr[(int)self->conn_p];
292 self->faddr = tfaddr[(int)self->conn_p];
293 self->lport = tlport[(int)self->conn_p];
294 self->fport = tfport[(int)self->conn_p];
297 /* follow inetd -> in.* transitions */
298 self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
299 execname : tname[(int)self->conn_p];
300 self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
301 pid : tpid[(int)self->conn_p];
302 tname[(int)self->conn_p] = self->name;
303 tpid[(int)self->conn_p] = self->pid;
309 fbt:ip:tcp_rput_data:entry
311 self->conn_p = (conn_t *)arg0;
312 self->size = msgdsize(args[1]) + 14; /* should check trailers */
315 fbt:ip:tcp_rput_data:entry
316 /tok[(int)self->conn_p]/
319 self->uid = tuid[(int)self->conn_p];
320 self->laddr = tladdr[(int)self->conn_p];
321 self->faddr = tfaddr[(int)self->conn_p];
322 self->lport = tlport[(int)self->conn_p];
323 self->fport = tfport[(int)self->conn_p];
326 /* follow inetd -> in.* transitions */
327 self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
328 execname : tname[(int)self->conn_p];
329 self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
330 pid : tpid[(int)self->conn_p];
331 tname[(int)self->conn_p] = self->name;
332 tpid[(int)self->conn_p] = self->pid;
336 * TCP Complete printing outbound handshake
338 fbt:ip:tcp_connect:return
341 self->name = tname[(int)self->connp];
342 self->pid = tpid[(int)self->connp];
343 self->uid = tuid[(int)self->connp];
344 self->size = 54; /* should check trailers */
346 /* this packet occured before connp was fully established */
347 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
348 self->uid, self->pid, self->laddr, self->lport, self->dir,
349 self->faddr, self->fport, self->size, self->name);
353 * TCP Complete printing inbound handshake
355 fbt:sockfs:sotpi_accept:return
358 self->name = tname[(int)self->connp];
359 self->pid = tpid[(int)self->connp];
360 self->uid = tuid[(int)self->connp];
361 self->size = 54; /* should check trailers */
362 /* these packets occured before connp was fully established */
364 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
365 self->uid, self->pid, self->laddr, self->lport, self->dir,
366 self->faddr, self->fport, self->size, self->name);
368 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
369 self->uid, self->pid, self->laddr, self->lport, self->dir,
370 self->faddr, self->fport, self->size, self->name);
372 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
373 self->uid, self->pid, self->laddr, self->lport, self->dir,
374 self->faddr, self->fport, self->size, self->name);
380 fbt:ip:tcp_send_data:entry,
381 fbt:ip:tcp_rput_data:entry
384 /* print output line */
385 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
386 self->uid, self->pid, self->laddr, self->lport, self->dir,
387 self->faddr, self->fport, self->size, self->name);
391 * TCP Clear connect variables
393 fbt:sockfs:sotpi_accept:return,
394 fbt:ip:tcp_connect:return
408 * TCP Clear r/w variables
410 fbt:ip:tcp_send_data:entry,
411 fbt:ip:tcp_rput_data:entry