aboutsummaryrefslogtreecommitdiff
path: root/Net/tcpsnoop
diff options
context:
space:
mode:
Diffstat (limited to 'Net/tcpsnoop')
-rwxr-xr-xNet/tcpsnoop581
1 files changed, 581 insertions, 0 deletions
diff --git a/Net/tcpsnoop b/Net/tcpsnoop
new file mode 100755
index 000000000000..e06912de015c
--- /dev/null
+++ b/Net/tcpsnoop
@@ -0,0 +1,581 @@
+#!/usr/bin/ksh
+#
+# tcpsnoop - snoop TCP network packets by process.
+# Written using DTrace (Solaris 10 3/05)
+#
+# This analyses TCP network packets and prints the responsible PID and UID,
+# plus standard details such as IP address and port. This captures traffic
+# of newly created TCP connections that were established while this program
+# was running. It can help identify which processes is causing TCP traffic.
+#
+# WARNING: This script may only work on Solaris 10 3/05, since it uses the
+# fbt provider to trace the raw operation of a specific version of the kernel.
+# In the future, a 'stable' network provider should exist which will allow
+# this to be written for that and subsequent versions of the kernel. In the
+# meantime, check for other versions of this script in the /Net directory,
+# and read the Notes/ALLfbt_notes.txt for more background on fbt.
+#
+# $Id: tcpsnoop 69 2007-10-04 13:40:00Z brendan $
+#
+# USAGE: tcpsnoop [-a|hjsvZ] [-n name] [-p pid]
+#
+# -a # print all data
+# -j # print project ID
+# -s # print time, us
+# -v # print time, string
+# -Z # print zone ID
+# -n name # command name to snoop
+# -p pid # PID to snoop
+# eg,
+# tcpsnoop -v # human readable timestamps
+# tcpsnoop -Z # print zonename
+# tcpsnoop -n sshd # snoop sshd traffic only
+#
+# FIELDS:
+# UID user ID
+# PID process ID
+# CMD command
+# LADDR local IP address
+# RADDR remote IP address
+# LPORT local port number
+# RPORT remote port number
+# DR direction
+# SIZE packet size, bytes
+# TIME timestamp, us
+# STRTIME human readable timestamp, string
+# ZONE zone ID
+# PROJ project ID
+#
+# SEE ALSO: snoop -rS
+#
+# COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg.
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License"). You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at Docs/cddl1.txt
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# CDDL HEADER END
+#
+# Author: Brendan Gregg [Sydney, Australia]
+#
+# TODO: IPv6
+#
+# CODE:
+# The FILTER syntax matches on packets rather than initial
+# connections, so that it can follow inetd connections properly.
+#
+# 09-Jul-2004 Brendan Gregg Created this.
+# 12-Mar-2005 " " Changed probes, size info now printed.
+# 02-Jul-2005 " " Many more probes. Renamed "tcpsnoop.d".
+# 04-Jul-2005 " " Now wrapped in shell, called "tcpsnoop".
+# 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct
+# execname. Thanks Kias Belgaied for expertise.
+# 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+.
+# 20-Apr-2006 " " Last update.
+#
+
+##############################
+# --- Process Arguments ---
+#
+
+### default variables
+opt_name=0; opt_time=0; opt_timestr=0; filter=0; pname=.
+opt_zone=0; opt_proj=0; opt_pid=0; pid=0
+
+### process options
+while getopts ahjsvZn:p: name
+do
+ case $name in
+ a) opt_time=1; opt_timestr=1; opt_zone=1; opt_proj=1 ;;
+ n) opt_name=1; pname=$OPTARG ;;
+ p) opt_pid=1; pid=$OPTARG ;;
+ j) opt_proj=1 ;;
+ s) opt_time=1 ;;
+ v) opt_timestr=1 ;;
+ Z) opt_zone=1 ;;
+ h|?) cat <<-END >&2
+ USAGE: tcpsnoop [-a|hjsvZ] [-n name] [-p pid]
+ tcpsnoop # default output
+ -a # print all data
+ -j # print project ID
+ -s # print start time, us
+ -v # print start time, string
+ -Z # print zonename
+ -n name # command name to snoop
+ -p pid # PID to snoop
+ eg,
+ tcpsnoop -v # human readable timestamps
+ tcpsnoop -Z # print zonename
+ tcpsnoop -n sshd # snoop sshd traffic only
+ END
+ exit 1
+ esac
+done
+
+### option logic
+if (( opt_name || opt_pid )); then
+ filter=1
+fi
+
+#################################
+# --- Main Program, DTrace ---
+#
+/usr/sbin/dtrace -Cs <( print -r '
+ /*
+ * Command line arguments
+ */
+ inline int OPT_name = '$opt_name';
+ inline int OPT_pid = '$opt_pid';
+ inline int OPT_time = '$opt_time';
+ inline int OPT_timestr = '$opt_timestr';
+ inline int OPT_zone = '$opt_zone';
+ inline int OPT_proj = '$opt_proj';
+ inline int PID = '$pid';
+ inline int FILTER = '$filter';
+ inline string NAME = "'$pname'";
+
+#pragma D option quiet
+#pragma D option switchrate=10hz
+
+#include <sys/file.h>
+#include <inet/common.h>
+#include <sys/byteorder.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+
+/*
+ * Print header
+ */
+dtrace:::BEGIN
+{
+ /* print optional headers */
+ OPT_time ? printf("%-14s ", "TIME") : 1;
+ OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
+ OPT_zone ? printf("%4s ", "ZONE") : 1;
+ OPT_proj ? printf("%4s ", "PROJ") : 1;
+
+ /* print main headers */
+ printf("%5s %6s %-15s %5s %2s %-15s %5s %5s %s\n",
+ "UID", "PID", "LADDR", "LPORT", "DR", "RADDR", "RPORT",
+ "SIZE", "CMD");
+}
+
+
+/*
+ * TCP Process inbound connections
+ *
+ * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was
+ * renamed to SS_DIRECT around build 31.
+ */
+fbt:sockfs:sotpi_accept:entry
+/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/
+{
+ self->sop = args[0];
+}
+
+fbt:sockfs:sotpi_create:return
+/self->sop/
+{
+ self->nsop = (struct sonode *)arg1;
+}
+
+fbt:sockfs:sotpi_accept:return
+/self->nsop/
+{
+ this->tcpp = (tcp_t *)self->nsop->so_priv;
+ self->connp = (conn_t *)this->tcpp->tcp_connp;
+ tname[(int)self->connp] = execname;
+ tpid[(int)self->connp] = pid;
+ tuid[(int)self->connp] = uid;
+}
+
+fbt:sockfs:sotpi_accept:return
+{
+ self->nsop = 0;
+ self->sop = 0;
+}
+
+/*
+ * TCP Process outbound connections
+ */
+fbt:ip:tcp_connect:entry
+{
+ this->tcpp = (tcp_t *)arg0;
+ self->connp = (conn_t *)this->tcpp->tcp_connp;
+ tname[(int)self->connp] = execname;
+ tpid[(int)self->connp] = pid;
+ tuid[(int)self->connp] = uid;
+ OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1;
+}
+
+/*
+ * TCP Data translations
+ */
+fbt:sockfs:sotpi_accept:return,
+fbt:ip:tcp_connect:return
+/self->connp/
+{
+ /* fetch ports */
+#if defined(_BIG_ENDIAN)
+ self->lport = self->connp->u_port.tcpu_ports.tcpu_lport;
+ self->fport = self->connp->u_port.tcpu_ports.tcpu_fport;
+#else
+ self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport);
+ self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport);
+#endif
+
+ /* fetch IPv4 addresses */
+ this->fad12 =
+ (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12];
+ this->fad13 =
+ (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13];
+ this->fad14 =
+ (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14];
+ this->fad15 =
+ (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15];
+ this->lad12 =
+ (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12];
+ this->lad13 =
+ (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13];
+ this->lad14 =
+ (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14];
+ this->lad15 =
+ (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15];
+
+ /* convert type for use with lltostr() */
+ this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12;
+ this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13;
+ this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14;
+ this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15;
+ this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12;
+ this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13;
+ this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14;
+ this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15;
+
+ /* stringify addresses */
+ self->faddr = strjoin(lltostr(this->fad12), ".");
+ self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
+ self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
+ self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
+ self->laddr = strjoin(lltostr(this->lad12), ".");
+ self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
+ self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
+ self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
+
+ /* fix direction and save values */
+ tladdr[(int)self->connp] = self->laddr;
+ tfaddr[(int)self->connp] = self->faddr;
+ tlport[(int)self->connp] = self->lport;
+ tfport[(int)self->connp] = self->fport;
+
+ /* all systems go */
+ tok[(int)self->connp] = 1;
+}
+
+/*
+ * TCP Clear connp
+ */
+fbt:ip:tcp_get_conn:return
+{
+ /* Q_TO_CONN */
+ this->connp = (conn_t *)arg1;
+ tok[(int)this->connp] = 0;
+ tpid[(int)this->connp] = 0;
+ tuid[(int)this->connp] = 0;
+ tname[(int)this->connp] = 0;
+ tproj[(int)this->connp] = 0;
+}
+
+/*
+ * TCP Process "port closed"
+ */
+fbt:ip:tcp_xmit_early_reset:entry
+/FILTER == 0/
+{
+ this->queuep = (queue_t *)`tcp_g_q; /* ` */
+ this->connp = (conn_t *)this->queuep->q_ptr;
+ this->tcpp = (tcp_t *)this->connp->conn_tcp;
+ self->zoneid = this->connp->conn_zoneid;
+
+ /* split addresses */
+ this->ipha = (ipha_t *)args[1]->b_rptr;
+ this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24;
+ this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16;
+ this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8;
+ this->fad12 = (this->ipha->ipha_src & 0x000000ff);
+ this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24;
+ this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16;
+ this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8;
+ this->lad12 = (this->ipha->ipha_dst & 0x000000ff);
+
+ /* stringify addresses */
+ self->faddr = strjoin(lltostr(this->fad12), ".");
+ self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
+ self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
+ self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
+ self->laddr = strjoin(lltostr(this->lad12), ".");
+ self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
+ self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
+ self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
+
+ self->reset = 1;
+}
+
+/*
+ * TCP Fetch "port closed" ports
+ */
+fbt:ip:tcp_xchg:entry
+/self->reset/
+{
+#if defined(_BIG_ENDIAN)
+ self->lport = (uint16_t)arg0;
+ self->fport = (uint16_t)arg1;
+#else
+ self->lport = BSWAP_16((uint16_t)arg0);
+ self->fport = BSWAP_16((uint16_t)arg1);
+#endif
+ self->lport = BE16_TO_U16(arg0);
+ self->fport = BE16_TO_U16(arg1);
+}
+
+/*
+ * TCP Print "port closed"
+ */
+fbt:ip:tcp_xmit_early_reset:return
+/FILTER == 0/
+{
+ self->name = "<closed>";
+ self->pid = 0;
+ self->uid = 0;
+ self->proj = 0;
+ self->size = 54; /* should check trailers */
+ self->dir = "<-";
+ OPT_time ? printf("%-14d ", timestamp/1000) : 1;
+ OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
+ OPT_zone ? printf("%4d ", self->zoneid) : 1;
+ OPT_proj ? printf("%4d ", self->proj) : 1;
+ printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
+ self->uid, self->pid, self->laddr, self->lport, self->dir,
+ self->faddr, self->fport, self->size, self->name);
+ self->dir = "->";
+ OPT_time ? printf("%-14d ", timestamp/1000) : 1;
+ OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
+ OPT_zone ? printf("%4d ", self->zoneid) : 1;
+ OPT_proj ? printf("%4d ", self->proj) : 1;
+ printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
+ self->uid, self->pid, self->laddr, self->lport, self->dir,
+ self->faddr, self->fport, self->size, self->name);
+ self->reset = 0;
+ self->size = 0;
+ self->name = 0;
+ self->zoneid = 0;
+}
+
+/*
+ * TCP Process Write
+ */
+fbt:ip:tcp_send_data:entry
+{
+ self->conn_p = (conn_t *)args[0]->tcp_connp;
+}
+
+fbt:ip:tcp_send_data:entry
+/tok[(int)self->conn_p]/
+{
+ self->dir = "->";
+ self->size = msgdsize(args[2]) + 14; /* should check trailers */
+ self->uid = tuid[(int)self->conn_p];
+ self->laddr = tladdr[(int)self->conn_p];
+ self->faddr = tfaddr[(int)self->conn_p];
+ self->lport = tlport[(int)self->conn_p];
+ self->fport = tfport[(int)self->conn_p];
+ OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1;
+ self->zoneid = self->conn_p->conn_zoneid;
+ self->ok = 2;
+
+ /* follow inetd -> in.* transitions */
+ self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
+ execname : tname[(int)self->conn_p];
+ self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
+ pid : tpid[(int)self->conn_p];
+ tname[(int)self->conn_p] = self->name;
+ tpid[(int)self->conn_p] = self->pid;
+}
+
+/*
+ * TCP Process Read
+ */
+fbt:ip:tcp_rput_data:entry
+{
+ self->conn_p = (conn_t *)arg0;
+ self->size = msgdsize(args[1]) + 14; /* should check trailers */
+}
+
+fbt:ip:tcp_rput_data:entry
+/tok[(int)self->conn_p]/
+{
+ self->dir = "<-";
+ self->uid = tuid[(int)self->conn_p];
+ self->laddr = tladdr[(int)self->conn_p];
+ self->faddr = tfaddr[(int)self->conn_p];
+ self->lport = tlport[(int)self->conn_p];
+ self->fport = tfport[(int)self->conn_p];
+ OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1;
+ self->zoneid = self->conn_p->conn_zoneid;
+ self->ok = 2;
+
+ /* follow inetd -> in.* transitions */
+ self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
+ execname : tname[(int)self->conn_p];
+ self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
+ pid : tpid[(int)self->conn_p];
+ tname[(int)self->conn_p] = self->name;
+ tpid[(int)self->conn_p] = self->pid;
+}
+
+/*
+ * TCP Complete printing outbound handshake
+ */
+fbt:ip:tcp_connect:return
+/self->connp/
+{
+ self->name = tname[(int)self->connp];
+ self->pid = tpid[(int)self->connp];
+ self->uid = tuid[(int)self->connp];
+ self->zoneid = self->connp->conn_zoneid;
+ OPT_proj ? self->proj = tproj[(int)self->connp] : 1;
+ self->size = 54; /* should check trailers */
+ self->dir = "->";
+}
+
+fbt:ip:tcp_connect:return
+/(self->connp) &&
+ ((FILTER == 0) ||
+ (OPT_pid && self->pid == PID) ||
+ (OPT_name && self->name == NAME))/
+{
+ /* this packet occured before connp was fully established */
+ OPT_time ? printf("%-14d ", timestamp/1000) : 1;
+ OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
+ OPT_zone ? printf("%4d ", self->zoneid) : 1;
+ OPT_proj ? printf("%4d ", self->proj) : 1;
+ printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
+ self->uid, self->pid, self->laddr, self->lport, self->dir,
+ self->faddr, self->fport, self->size, self->name);
+}
+
+/*
+ * TCP Complete printing inbound handshake
+ */
+fbt:sockfs:sotpi_accept:return
+/self->connp/
+{
+ self->name = tname[(int)self->connp];
+ self->pid = tpid[(int)self->connp];
+ self->uid = tuid[(int)self->connp];
+ self->zoneid = self->connp->conn_zoneid;
+ OPT_proj ? self->proj = tproj[(int)self->connp] : 1;
+ self->size = 54; /* should check trailers */
+ self->dir = "<-";
+}
+
+fbt:sockfs:sotpi_accept:return
+/(self->connp) &&
+ ((FILTER == 0) ||
+ (OPT_pid && self->pid == PID) ||
+ (OPT_name && self->name == NAME))/
+{
+ /* these packets occured before connp was fully established */
+ OPT_time ? printf("%-14d ", timestamp/1000) : 1;
+ OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
+ OPT_zone ? printf("%4d ", self->zoneid) : 1;
+ OPT_proj ? printf("%4d ", self->proj) : 1;
+ printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
+ self->uid, self->pid, self->laddr, self->lport, self->dir,
+ self->faddr, self->fport, self->size, self->name);
+ self->dir = "->";
+ OPT_time ? printf("%-14d ", timestamp/1000) : 1;
+ OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
+ OPT_zone ? printf("%4d ", self->zoneid) : 1;
+ OPT_proj ? printf("%4d ", self->proj) : 1;
+ printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
+ self->uid, self->pid, self->laddr, self->lport, self->dir,
+ self->faddr, self->fport, self->size, self->name);
+ self->dir = "<-";
+ OPT_time ? printf("%-14d ", timestamp/1000) : 1;
+ OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
+ OPT_zone ? printf("%4d ", self->zoneid) : 1;
+ OPT_proj ? printf("%4d ", self->proj) : 1;
+ printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
+ self->uid, self->pid, self->laddr, self->lport, self->dir,
+ self->faddr, self->fport, self->size, self->name);
+}
+
+/*
+ * Print output
+ */
+fbt:ip:tcp_send_data:entry,
+fbt:ip:tcp_rput_data:entry
+/(self->ok == 2) &&
+ ((FILTER == 0) ||
+ (OPT_pid && self->pid == PID) ||
+ (OPT_name && self->name == NAME))/
+{
+ /* print optional fields */
+ OPT_time ? printf("%-14d ", timestamp/1000) : 1;
+ OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
+ OPT_zone ? printf("%4d ", self->zoneid) : 1;
+ OPT_proj ? printf("%4d ", self->proj) : 1;
+
+ /* print output line */
+ printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
+ self->uid, self->pid, self->laddr, self->lport, self->dir,
+ self->faddr, self->fport, self->size, self->name);
+}
+
+/*
+ * TCP Clear connect variables
+ */
+fbt:sockfs:sotpi_accept:return,
+fbt:ip:tcp_connect:return
+/self->connp/
+{
+ self->faddr = 0;
+ self->laddr = 0;
+ self->fport = 0;
+ self->lport = 0;
+ self->connp = 0;
+ self->name = 0;
+ self->pid = 0;
+ self->uid = 0;
+}
+
+/*
+ * TCP Clear r/w variables
+ */
+fbt:ip:tcp_send_data:entry,
+fbt:ip:tcp_rput_data:entry
+{
+ self->ok = 0;
+ self->dir = 0;
+ self->uid = 0;
+ self->pid = 0;
+ self->size = 0;
+ self->name = 0;
+ self->lport = 0;
+ self->fport = 0;
+ self->laddr = 0;
+ self->faddr = 0;
+ self->conn_p = 0;
+ self->zoneid = 0;
+ self->proj = 0;
+}
+')
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-16 04:12:35 +0000