diff options
Diffstat (limited to 'cddl/contrib/dtracetoolkit/Net')
-rw-r--r-- | cddl/contrib/dtracetoolkit/Net/Readme | 4 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/connections | 178 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/icmpstat.d | 61 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/tcpsnoop | 581 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/tcpsnoop.d | 424 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/tcpsnoop_snv | 583 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/tcpsnoop_snv.d | 426 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/tcpstat.d | 91 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/tcptop | 579 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/tcptop_snv | 581 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/tcpwdist.d | 82 | ||||
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Net/udpstat.d | 92 |
12 files changed, 3682 insertions, 0 deletions
diff --git a/cddl/contrib/dtracetoolkit/Net/Readme b/cddl/contrib/dtracetoolkit/Net/Readme new file mode 100644 index 000000000000..3a53744ebe27 --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/Readme @@ -0,0 +1,4 @@ +Net - Network based analysis + + These scripts analyse activity of the network interfaces, the TCP/IP + stack, socket activity, etc. diff --git a/cddl/contrib/dtracetoolkit/Net/connections b/cddl/contrib/dtracetoolkit/Net/connections new file mode 100755 index 000000000000..523b880b14ce --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/connections @@ -0,0 +1,178 @@ +#!/usr/bin/ksh +# +# connections - print inbound TCP connections by process. +# Written in DTrace (Solaris 10 3/05). +# +# This displays the PID and command name of the processes accepting +# connections, along with the source IP address and destination port number. +# +# $Id: connections 3 2007-08-01 10:50:08Z brendan $ +# +# USAGE: connections [-htvZ] +# +# -t # print timestamps, us +# -v # print timestamps, string +# -Z # print zonename +# eg, +# connections -v # snoop connections with times +# +# FIELDS: +# UID user ID of the server +# PID process ID for the server +# CMD server command name +# TIME timestamp, us +# TIMESTR timestamp, string +# PORT server port +# IP_SOURCE source IP of the client, written in IPv4 style +# ZONE zonename +# +# SEE ALSO: snoop 'tcp[13:1] = 0x02' # snoop new connections +# +# COPYRIGHT: Copyright (c) 2005 Brendan Gregg. +# +# CDDL HEADER START +# +# The contents of this file are subject to the terms of the +# Common Development and Distribution License, Version 1.0 only +# (the "License"). You may not use this file except in compliance +# with the License. +# +# You can obtain a copy of the license at Docs/cddl1.txt +# or http://www.opensolaris.org/os/licensing. +# See the License for the specific language governing permissions +# and limitations under the License. +# +# CDDL HEADER END +# +# TODO: IPv6 +# +# 10-Apr-2004 Brendan Gregg Created this. +# 23-May-2004 " " Fixed issues on SPARC. +# 08-May-2005 " " Updated for newer Solaris 10. +# 17-Jun-2005 " " Rewrote, changed probes, wrapped in sh. +# 04-Dec-2005 " " Changed tcp_accept_finish -> sotpi_accept +# 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. +# 20-Apr-2006 " " Last update. +# + + +############################## +# --- Process Arguments --- +# + +### Default variables +opt_time=0; opt_timestr=0; opt_zone=0 + +### Process options +while getopts htvZ name +do + case $name in + t) opt_time=1 ;; + v) opt_timestr=1 ;; + Z) opt_zone=1 ;; + h|?) cat <<-END >&2 + USAGE: connections [-htvZ] + -t # print timestamps, us + -v # print timestamps, string + -Z # print zonename + eg, + connections -v # snoop connections with times + END + exit 1 + esac +done + + +################################# +# --- Main Program, DTrace --- +# +/usr/sbin/dtrace -C -s <( print -r ' +#include <sys/file.h> +#include <sys/types.h> +#include <sys/byteorder.h> +#include <sys/socket.h> +#include <sys/socketvar.h> + + #pragma D option quiet + #pragma D option switchrate=10hz + + inline int OPT_time = '$opt_time'; + inline int OPT_timestr = '$opt_timestr'; + inline int OPT_zone = '$opt_zone'; + + /* + * Print header + */ + dtrace:::BEGIN + { + /* print optional headers */ + OPT_time ? printf("%-14s ", "TIME") : 1; + OPT_timestr ? printf("%-20s ", "TIMESTR") : 1; + OPT_zone ? printf("%-10s ", "ZONE") : 1; + + /* print header */ + printf("%5s %5s %-12s %4s %5s %s\n", + "UID", "PID", "CMD", "TYPE", "PORT", "IP_SOURCE"); + } + + /* + * TCP Process inbound connections + * + * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was + * renamed to SS_DIRECT around build 31. + */ + fbt:sockfs:sotpi_accept:entry + /(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ + { + self->sop = args[0]; + } + + fbt:sockfs:sotpi_create:return + /self->sop/ + { + self->nsop = (struct sonode *)arg1; + } + + + /* + * Probe TCP connections + */ + fbt:sockfs:sotpi_accept:return + /self->nsop/ + { + /* fetch connection details */ + this->tcpp = (tcp_t *)self->nsop->so_priv; + this->connp = (conn_t *)this->tcpp->tcp_connp; + +#if defined(_BIG_ENDIAN) + this->port0 = this->connp->u_port.tcpu_ports.tcpu_lport; +#else + this->port0 = BSWAP_16(this->connp->u_port.tcpu_ports.tcpu_lport); +#endif + this->rem12 = + (uint8_t)this->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; + this->rem13 = + (uint8_t)this->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; + this->rem14 = + (uint8_t)this->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; + this->rem15 = + (uint8_t)this->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; + + /* print optional fields */ + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%-10s ", zonename) : 1; + + /* print output line */ + printf("%5d %5d %-12s %4s %5d %d.%d.%d.%d\n", + uid, pid, execname, "tcp", this->port0, + this->rem12, this->rem13, this->rem14, this->rem15); + } + + fbt:sockfs:sotpi_accept:return + { + self->nsop = 0; + self->sop = 0; + } +') + diff --git a/cddl/contrib/dtracetoolkit/Net/icmpstat.d b/cddl/contrib/dtracetoolkit/Net/icmpstat.d new file mode 100755 index 000000000000..3df519999e33 --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/icmpstat.d @@ -0,0 +1,61 @@ +#!/usr/sbin/dtrace -s +/* + * icmpstat.d - print ICMP statistics. Uses DTrace. + * + * This prints ICMP statistics every second, retrieved from the MIB provider. + * This is a simple script to demonstrate the ability to trace ICMP events. + * + * $Id: icmpstat.d 3 2007-08-01 10:50:08Z brendan $ + * + * USAGE: icmpstat.d + * + * FIELDS: + * STATISTIC ICMP statistic name + * VALUE total of statistic during sample + * + * The above ICMP statistics are documented in the mib2_icmp struct + * in the /usr/include/inet/mib2.h file; and also in the mib provider + * chapter of the DTrace Guide, http://docs.sun.com/db/doc/817-6223. + * + * COPYRIGHT: Copyright (c) 2005 Brendan Gregg. + * + * CDDL HEADER START + * + * The contents of this file are subject to the terms of the + * Common Development and Distribution License, Version 1.0 only + * (the "License"). You may not use this file except in compliance + * with the License. + * + * You can obtain a copy of the license at Docs/cddl1.txt + * or http://www.opensolaris.org/os/licensing. + * See the License for the specific language governing permissions + * and limitations under the License. + * + * CDDL HEADER END + * + * 25-Jul-2005 Brendan Gregg Created this. + * 25-Jul-2005 " " Last update. + */ + +#pragma D option quiet + +/* + * Save Data + */ +mib:::icmp* +{ + @icmp[probename] = sum(arg0); +} + +/* + * Print Output + */ +profile:::tick-1sec +{ + printf("%Y,\n\n", walltimestamp); + printf("%32s %8s\n", "STATISTIC", "VALUE"); + printa("%32s %@8d\n", @icmp); + printf("\n"); + + trunc(@icmp); +} diff --git a/cddl/contrib/dtracetoolkit/Net/tcpsnoop b/cddl/contrib/dtracetoolkit/Net/tcpsnoop new file mode 100755 index 000000000000..e06912de015c --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/tcpsnoop @@ -0,0 +1,581 @@ +#!/usr/bin/ksh +# +# tcpsnoop - snoop TCP network packets by process. +# Written using DTrace (Solaris 10 3/05) +# +# This analyses TCP network packets and prints the responsible PID and UID, +# plus standard details such as IP address and port. This captures traffic +# of newly created TCP connections that were established while this program +# was running. It can help identify which processes is causing TCP traffic. +# +# WARNING: This script may only work on Solaris 10 3/05, since it uses the +# fbt provider to trace the raw operation of a specific version of the kernel. +# In the future, a 'stable' network provider should exist which will allow +# this to be written for that and subsequent versions of the kernel. In the +# meantime, check for other versions of this script in the /Net directory, +# and read the Notes/ALLfbt_notes.txt for more background on fbt. +# +# $Id: tcpsnoop 69 2007-10-04 13:40:00Z brendan $ +# +# USAGE: tcpsnoop [-a|hjsvZ] [-n name] [-p pid] +# +# -a # print all data +# -j # print project ID +# -s # print time, us +# -v # print time, string +# -Z # print zone ID +# -n name # command name to snoop +# -p pid # PID to snoop +# eg, +# tcpsnoop -v # human readable timestamps +# tcpsnoop -Z # print zonename +# tcpsnoop -n sshd # snoop sshd traffic only +# +# FIELDS: +# UID user ID +# PID process ID +# CMD command +# LADDR local IP address +# RADDR remote IP address +# LPORT local port number +# RPORT remote port number +# DR direction +# SIZE packet size, bytes +# TIME timestamp, us +# STRTIME human readable timestamp, string +# ZONE zone ID +# PROJ project ID +# +# SEE ALSO: snoop -rS +# +# COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. +# +# CDDL HEADER START +# +# The contents of this file are subject to the terms of the +# Common Development and Distribution License, Version 1.0 only +# (the "License"). You may not use this file except in compliance +# with the License. +# +# You can obtain a copy of the license at Docs/cddl1.txt +# or http://www.opensolaris.org/os/licensing. +# See the License for the specific language governing permissions +# and limitations under the License. +# +# CDDL HEADER END +# +# Author: Brendan Gregg [Sydney, Australia] +# +# TODO: IPv6 +# +# CODE: +# The FILTER syntax matches on packets rather than initial +# connections, so that it can follow inetd connections properly. +# +# 09-Jul-2004 Brendan Gregg Created this. +# 12-Mar-2005 " " Changed probes, size info now printed. +# 02-Jul-2005 " " Many more probes. Renamed "tcpsnoop.d". +# 04-Jul-2005 " " Now wrapped in shell, called "tcpsnoop". +# 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct +# execname. Thanks Kias Belgaied for expertise. +# 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. +# 20-Apr-2006 " " Last update. +# + +############################## +# --- Process Arguments --- +# + +### default variables +opt_name=0; opt_time=0; opt_timestr=0; filter=0; pname=. +opt_zone=0; opt_proj=0; opt_pid=0; pid=0 + +### process options +while getopts ahjsvZn:p: name +do + case $name in + a) opt_time=1; opt_timestr=1; opt_zone=1; opt_proj=1 ;; + n) opt_name=1; pname=$OPTARG ;; + p) opt_pid=1; pid=$OPTARG ;; + j) opt_proj=1 ;; + s) opt_time=1 ;; + v) opt_timestr=1 ;; + Z) opt_zone=1 ;; + h|?) cat <<-END >&2 + USAGE: tcpsnoop [-a|hjsvZ] [-n name] [-p pid] + tcpsnoop # default output + -a # print all data + -j # print project ID + -s # print start time, us + -v # print start time, string + -Z # print zonename + -n name # command name to snoop + -p pid # PID to snoop + eg, + tcpsnoop -v # human readable timestamps + tcpsnoop -Z # print zonename + tcpsnoop -n sshd # snoop sshd traffic only + END + exit 1 + esac +done + +### option logic +if (( opt_name || opt_pid )); then + filter=1 +fi + +################################# +# --- Main Program, DTrace --- +# +/usr/sbin/dtrace -Cs <( print -r ' + /* + * Command line arguments + */ + inline int OPT_name = '$opt_name'; + inline int OPT_pid = '$opt_pid'; + inline int OPT_time = '$opt_time'; + inline int OPT_timestr = '$opt_timestr'; + inline int OPT_zone = '$opt_zone'; + inline int OPT_proj = '$opt_proj'; + inline int PID = '$pid'; + inline int FILTER = '$filter'; + inline string NAME = "'$pname'"; + +#pragma D option quiet +#pragma D option switchrate=10hz + +#include <sys/file.h> +#include <inet/common.h> +#include <sys/byteorder.h> +#include <sys/socket.h> +#include <sys/socketvar.h> + +/* + * Print header + */ +dtrace:::BEGIN +{ + /* print optional headers */ + OPT_time ? printf("%-14s ", "TIME") : 1; + OPT_timestr ? printf("%-20s ", "STRTIME") : 1; + OPT_zone ? printf("%4s ", "ZONE") : 1; + OPT_proj ? printf("%4s ", "PROJ") : 1; + + /* print main headers */ + printf("%5s %6s %-15s %5s %2s %-15s %5s %5s %s\n", + "UID", "PID", "LADDR", "LPORT", "DR", "RADDR", "RPORT", + "SIZE", "CMD"); +} + + +/* + * TCP Process inbound connections + * + * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was + * renamed to SS_DIRECT around build 31. + */ +fbt:sockfs:sotpi_accept:entry +/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ +{ + self->sop = args[0]; +} + +fbt:sockfs:sotpi_create:return +/self->sop/ +{ + self->nsop = (struct sonode *)arg1; +} + +fbt:sockfs:sotpi_accept:return +/self->nsop/ +{ + this->tcpp = (tcp_t *)self->nsop->so_priv; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; +} + +fbt:sockfs:sotpi_accept:return +{ + self->nsop = 0; + self->sop = 0; +} + +/* + * TCP Process outbound connections + */ +fbt:ip:tcp_connect:entry +{ + this->tcpp = (tcp_t *)arg0; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; + OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1; +} + +/* + * TCP Data translations + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + /* fetch ports */ +#if defined(_BIG_ENDIAN) + self->lport = self->connp->u_port.tcpu_ports.tcpu_lport; + self->fport = self->connp->u_port.tcpu_ports.tcpu_fport; +#else + self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport); + self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport); +#endif + + /* fetch IPv4 addresses */ + this->fad12 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; + this->fad13 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; + this->fad14 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; + this->fad15 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; + this->lad12 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12]; + this->lad13 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13]; + this->lad14 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14]; + this->lad15 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15]; + + /* convert type for use with lltostr() */ + this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12; + this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13; + this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14; + this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15; + this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12; + this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13; + this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14; + this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15; + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + /* fix direction and save values */ + tladdr[(int)self->connp] = self->laddr; + tfaddr[(int)self->connp] = self->faddr; + tlport[(int)self->connp] = self->lport; + tfport[(int)self->connp] = self->fport; + + /* all systems go */ + tok[(int)self->connp] = 1; +} + +/* + * TCP Clear connp + */ +fbt:ip:tcp_get_conn:return +{ + /* Q_TO_CONN */ + this->connp = (conn_t *)arg1; + tok[(int)this->connp] = 0; + tpid[(int)this->connp] = 0; + tuid[(int)this->connp] = 0; + tname[(int)this->connp] = 0; + tproj[(int)this->connp] = 0; +} + +/* + * TCP Process "port closed" + */ +fbt:ip:tcp_xmit_early_reset:entry +/FILTER == 0/ +{ + this->queuep = (queue_t *)`tcp_g_q; /* ` */ + this->connp = (conn_t *)this->queuep->q_ptr; + this->tcpp = (tcp_t *)this->connp->conn_tcp; + self->zoneid = this->connp->conn_zoneid; + + /* split addresses */ + this->ipha = (ipha_t *)args[1]->b_rptr; + this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24; + this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16; + this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8; + this->fad12 = (this->ipha->ipha_src & 0x000000ff); + this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24; + this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16; + this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8; + this->lad12 = (this->ipha->ipha_dst & 0x000000ff); + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + self->reset = 1; +} + +/* + * TCP Fetch "port closed" ports + */ +fbt:ip:tcp_xchg:entry +/self->reset/ +{ +#if defined(_BIG_ENDIAN) + self->lport = (uint16_t)arg0; + self->fport = (uint16_t)arg1; +#else + self->lport = BSWAP_16((uint16_t)arg0); + self->fport = BSWAP_16((uint16_t)arg1); +#endif + self->lport = BE16_TO_U16(arg0); + self->fport = BE16_TO_U16(arg1); +} + +/* + * TCP Print "port closed" + */ +fbt:ip:tcp_xmit_early_reset:return +/FILTER == 0/ +{ + self->name = "<closed>"; + self->pid = 0; + self->uid = 0; + self->proj = 0; + self->size = 54; /* should check trailers */ + self->dir = "<-"; + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "->"; + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->reset = 0; + self->size = 0; + self->name = 0; + self->zoneid = 0; +} + +/* + * TCP Process Write + */ +fbt:ip:tcp_send_data:entry +{ + self->conn_p = (conn_t *)args[0]->tcp_connp; +} + +fbt:ip:tcp_send_data:entry +/tok[(int)self->conn_p]/ +{ + self->dir = "->"; + self->size = msgdsize(args[2]) + 14; /* should check trailers */ + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; + self->zoneid = self->conn_p->conn_zoneid; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Process Read + */ +fbt:ip:tcp_rput_data:entry +{ + self->conn_p = (conn_t *)arg0; + self->size = msgdsize(args[1]) + 14; /* should check trailers */ +} + +fbt:ip:tcp_rput_data:entry +/tok[(int)self->conn_p]/ +{ + self->dir = "<-"; + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; + self->zoneid = self->conn_p->conn_zoneid; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Complete printing outbound handshake + */ +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->zoneid = self->connp->conn_zoneid; + OPT_proj ? self->proj = tproj[(int)self->connp] : 1; + self->size = 54; /* should check trailers */ + self->dir = "->"; +} + +fbt:ip:tcp_connect:return +/(self->connp) && + ((FILTER == 0) || + (OPT_pid && self->pid == PID) || + (OPT_name && self->name == NAME))/ +{ + /* this packet occured before connp was fully established */ + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * TCP Complete printing inbound handshake + */ +fbt:sockfs:sotpi_accept:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->zoneid = self->connp->conn_zoneid; + OPT_proj ? self->proj = tproj[(int)self->connp] : 1; + self->size = 54; /* should check trailers */ + self->dir = "<-"; +} + +fbt:sockfs:sotpi_accept:return +/(self->connp) && + ((FILTER == 0) || + (OPT_pid && self->pid == PID) || + (OPT_name && self->name == NAME))/ +{ + /* these packets occured before connp was fully established */ + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "->"; + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "<-"; + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * Print output + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +/(self->ok == 2) && + ((FILTER == 0) || + (OPT_pid && self->pid == PID) || + (OPT_name && self->name == NAME))/ +{ + /* print optional fields */ + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + + /* print output line */ + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * TCP Clear connect variables + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->faddr = 0; + self->laddr = 0; + self->fport = 0; + self->lport = 0; + self->connp = 0; + self->name = 0; + self->pid = 0; + self->uid = 0; +} + +/* + * TCP Clear r/w variables + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +{ + self->ok = 0; + self->dir = 0; + self->uid = 0; + self->pid = 0; + self->size = 0; + self->name = 0; + self->lport = 0; + self->fport = 0; + self->laddr = 0; + self->faddr = 0; + self->conn_p = 0; + self->zoneid = 0; + self->proj = 0; +} +') diff --git a/cddl/contrib/dtracetoolkit/Net/tcpsnoop.d b/cddl/contrib/dtracetoolkit/Net/tcpsnoop.d new file mode 100755 index 000000000000..ca01864522aa --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/tcpsnoop.d @@ -0,0 +1,424 @@ +#!/usr/sbin/dtrace -Cs +/* + * tcpsnoop.d - snoop TCP network packets by process. + * Written using DTrace (Solaris 10 3/05) + * + * This analyses TCP network packets and prints the responsible PID and UID, + * plus standard details such as IP address and port. This captures traffic + * of newly created TCP connections that were established while this program + * was running. It can help identify which processes is causing TCP traffic. + * + * WARNING: This script may only work on Solaris 10 3/05, since it uses the + * fbt provider to trace the raw operation of a specific version of the kernel. + * In the future, a 'stable' network provider should exist which will allow + * this to be written for that and subsequent versions of the kernel. In the + * meantime, check for other versions of this script in the /Net directory, + * and read the Notes/ALLfbt_notes.txt for more background on fbt. + * + * $Id: tcpsnoop.d 69 2007-10-04 13:40:00Z brendan $ + * + * USAGE: tcpsnoop.d + * + * FIELDS: + * UID user ID + * PID process ID + * CMD command + * LADDR local IP address + * RADDR remote IP address + * LPORT local port number + * RPORT remote port number + * DR direction + * SIZE packet size, bytes + * + * SEE ALSO: snoop -rS + * + * COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. + * + * CDDL HEADER START + * + * The contents of this file are subject to the terms of the + * Common Development and Distribution License, Version 1.0 only + * (the "License"). You may not use this file except in compliance + * with the License. + * + * You can obtain a copy of the license at Docs/cddl1.txt + * or http://www.opensolaris.org/os/licensing. + * See the License for the specific language governing permissions + * and limitations under the License. + * + * CDDL HEADER END + * + * Author: Brendan Gregg [Sydney, Australia] + * + * TODO: IPv6 + * + * 09-Jul-2004 Brendan Gregg Created this. + * 12-Mar-2005 " " Changed probes, size info now printed. + * 02-Jul-2005 " " Many more probes. Renamed "tcpsnoop.d". + * 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct + * execname. Thanks Kias Belgaied for expertise. + * 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. + * 20-Apr-2006 " " Last update. + */ + +#pragma D option quiet +#pragma D option switchrate=10hz + +#include <sys/file.h> +#include <inet/common.h> +#include <sys/byteorder.h> + +/* + * Print header + */ +dtrace:::BEGIN +{ + /* print main headers */ + printf("%5s %6s %-15s %5s %2s %-15s %5s %5s %s\n", + "UID", "PID", "LADDR", "LPORT", "DR", "RADDR", "RPORT", + "SIZE", "CMD"); +} + +/* + * TCP Process inbound connections + * + * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was + * renamed to SS_DIRECT around build 31. + */ +fbt:sockfs:sotpi_accept:entry +/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ +{ + self->sop = args[0]; +} + +fbt:sockfs:sotpi_create:return +/self->sop/ +{ + self->nsop = (struct sonode *)arg1; +} + +fbt:sockfs:sotpi_accept:return +/self->nsop/ +{ + this->tcpp = (tcp_t *)self->nsop->so_priv; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; +} + +fbt:sockfs:sotpi_accept:return +{ + self->nsop = 0; + self->sop = 0; +} + +/* + * TCP Process outbound connections + */ +fbt:ip:tcp_connect:entry +{ + this->tcpp = (tcp_t *)arg0; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; +} + +/* + * TCP Data translations + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + /* fetch ports */ +#if defined(_BIG_ENDIAN) + self->lport = self->connp->u_port.tcpu_ports.tcpu_lport; + self->fport = self->connp->u_port.tcpu_ports.tcpu_fport; +#else + self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport); + self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport); +#endif + + /* fetch IPv4 addresses */ + this->fad12 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; + this->fad13 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; + this->fad14 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; + this->fad15 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; + this->lad12 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12]; + this->lad13 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13]; + this->lad14 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14]; + this->lad15 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15]; + + /* convert type for use with lltostr() */ + this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12; + this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13; + this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14; + this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15; + this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12; + this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13; + this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14; + this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15; + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + /* fix direction and save values */ + tladdr[(int)self->connp] = self->laddr; + tfaddr[(int)self->connp] = self->faddr; + tlport[(int)self->connp] = self->lport; + tfport[(int)self->connp] = self->fport; + + /* all systems go */ + tok[(int)self->connp] = 1; +} + +/* + * TCP Clear connp + */ +fbt:ip:tcp_get_conn:return +{ + /* Q_TO_CONN */ + this->connp = (conn_t *)arg1; + tok[(int)this->connp] = 0; + tpid[(int)this->connp] = 0; + tuid[(int)this->connp] = 0; + tname[(int)this->connp] = 0; +} + +/* + * TCP Process "port closed" + */ +fbt:ip:tcp_xmit_early_reset:entry +{ + this->queuep = (queue_t *)`tcp_g_q; /* ` */ + this->connp = (conn_t *)this->queuep->q_ptr; + this->tcpp = (tcp_t *)this->connp->conn_tcp; + + /* split addresses */ + this->ipha = (ipha_t *)args[1]->b_rptr; + this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24; + this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16; + this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8; + this->fad12 = (this->ipha->ipha_src & 0x000000ff); + this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24; + this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16; + this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8; + this->lad12 = (this->ipha->ipha_dst & 0x000000ff); + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + self->reset = 1; +} + +/* + * TCP Fetch "port closed" ports + */ +fbt:ip:tcp_xchg:entry +/self->reset/ +{ +#if defined(_BIG_ENDIAN) + self->lport = (uint16_t)arg0; + self->fport = (uint16_t)arg1; +#else + self->lport = BSWAP_16((uint16_t)arg0); + self->fport = BSWAP_16((uint16_t)arg1); +#endif + self->lport = BE16_TO_U16(arg0); + self->fport = BE16_TO_U16(arg1); +} + +/* + * TCP Print "port closed" + */ +fbt:ip:tcp_xmit_early_reset:return +{ + self->name = "<closed>"; + self->pid = 0; + self->uid = 0; + self->size = 54; /* should check trailers */ + self->dir = "<-"; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "->"; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->reset = 0; + self->size = 0; + self->name = 0; +} + +/* + * TCP Process Write + */ +fbt:ip:tcp_send_data:entry +{ + self->conn_p = (conn_t *)args[0]->tcp_connp; +} + +fbt:ip:tcp_send_data:entry +/tok[(int)self->conn_p]/ +{ + self->dir = "->"; + self->size = msgdsize(args[2]) + 14; /* should check trailers */ + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Process Read + */ +fbt:ip:tcp_rput_data:entry +{ + self->conn_p = (conn_t *)arg0; + self->size = msgdsize(args[1]) + 14; /* should check trailers */ +} + +fbt:ip:tcp_rput_data:entry +/tok[(int)self->conn_p]/ +{ + self->dir = "<-"; + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Complete printing outbound handshake + */ +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->size = 54; /* should check trailers */ + self->dir = "->"; + /* this packet occured before connp was fully established */ + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * TCP Complete printing inbound handshake + */ +fbt:sockfs:sotpi_accept:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->size = 54; /* should check trailers */ + /* these packets occured before connp was fully established */ + self->dir = "<-"; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "->"; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "<-"; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * Print output + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +/self->ok == 2/ +{ + /* print output line */ + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * TCP Clear connect variables + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->faddr = 0; + self->laddr = 0; + self->fport = 0; + self->lport = 0; + self->connp = 0; + self->name = 0; + self->pid = 0; + self->uid = 0; +} + +/* + * TCP Clear r/w variables + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +{ + self->ok = 0; + self->dir = 0; + self->uid = 0; + self->pid = 0; + self->size = 0; + self->name = 0; + self->lport = 0; + self->fport = 0; + self->laddr = 0; + self->faddr = 0; + self->conn_p = 0; +} diff --git a/cddl/contrib/dtracetoolkit/Net/tcpsnoop_snv b/cddl/contrib/dtracetoolkit/Net/tcpsnoop_snv new file mode 100755 index 000000000000..85ebb6c898e2 --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/tcpsnoop_snv @@ -0,0 +1,583 @@ +#!/usr/bin/ksh +# +# tcpsnoop_snv - snoop TCP network packets by process. +# Written using DTrace (Solaris Nevada) +# +# This analyses TCP network packets and prints the responsible PID and UID, +# plus standard details such as IP address and port. This captures traffic +# of newly created TCP connections that were established while this program +# was running. It can help identify which processes is causing TCP traffic. +# +# WARNING: This script may only work on Solaris Nevada and OpenSolaris +# of the late 2007 vintage, since it uses the fbt provider to trace the raw +# operation of a specific version of the kernel. In the future, a 'stable' +# network provider should exist which will allow this to be written for that +# and subsequent versions of the kernel. In the meantime, check for other +# versions of this script in the /Net directory, and read the +# Notes/ALLfbt_notes.txt for more background on fbt. +# +# $Id: tcpsnoop_snv 69 2007-10-04 13:40:00Z brendan $ +# +# USAGE: tcpsnoop [-a|hjsvZ] [-n name] [-p pid] +# +# -a # print all data +# -j # print project ID +# -s # print time, us +# -v # print time, string +# -Z # print zone ID +# -n name # command name to snoop +# -p pid # PID to snoop +# eg, +# tcpsnoop -v # human readable timestamps +# tcpsnoop -Z # print zonename +# tcpsnoop -n sshd # snoop sshd traffic only +# +# FIELDS: +# UID user ID +# PID process ID +# CMD command +# LADDR local IP address +# RADDR remote IP address +# LPORT local port number +# RPORT remote port number +# DR direction +# SIZE packet size, bytes +# TIME timestamp, us +# STRTIME human readable timestamp, string +# ZONE zone ID +# PROJ project ID +# +# SEE ALSO: snoop -rS +# +# COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. +# +# CDDL HEADER START +# +# The contents of this file are subject to the terms of the +# Common Development and Distribution License, Version 1.0 only +# (the "License"). You may not use this file except in compliance +# with the License. +# +# You can obtain a copy of the license at Docs/cddl1.txt +# or http://www.opensolaris.org/os/licensing. +# See the License for the specific language governing permissions +# and limitations under the License. +# +# CDDL HEADER END +# +# Author: Brendan Gregg [Sydney, Australia] +# +# TODO: IPv6 +# +# CODE: +# The FILTER syntax matches on packets rather than initial +# connections, so that it can follow inetd connections properly. +# +# 09-Jul-2004 Brendan Gregg Created this. +# 12-Mar-2005 " " Changed probes, size info now printed. +# 02-Jul-2005 " " Many more probes. Renamed "tcpsnoop.d". +# 04-Jul-2005 " " Now wrapped in shell, called "tcpsnoop". +# 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct +# execname. Thanks Kias Belgaied for expertise. +# 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. +# 20-Apr-2006 " " Last update. +# 30-Sep-2007 " " Bumped this for recent OpenSolaris/Nevada. +# + +############################## +# --- Process Arguments --- +# + +### default variables +opt_name=0; opt_time=0; opt_timestr=0; filter=0; pname=. +opt_zone=0; opt_proj=0; opt_pid=0; pid=0 + +### process options +while getopts ahjsvZn:p: name +do + case $name in + a) opt_time=1; opt_timestr=1; opt_zone=1; opt_proj=1 ;; + n) opt_name=1; pname=$OPTARG ;; + p) opt_pid=1; pid=$OPTARG ;; + j) opt_proj=1 ;; + s) opt_time=1 ;; + v) opt_timestr=1 ;; + Z) opt_zone=1 ;; + h|?) cat <<-END >&2 + USAGE: tcpsnoop [-a|hjsvZ] [-n name] [-p pid] + tcpsnoop # default output + -a # print all data + -j # print project ID + -s # print start time, us + -v # print start time, string + -Z # print zonename + -n name # command name to snoop + -p pid # PID to snoop + eg, + tcpsnoop -v # human readable timestamps + tcpsnoop -Z # print zonename + tcpsnoop -n sshd # snoop sshd traffic only + END + exit 1 + esac +done + +### option logic +if (( opt_name || opt_pid )); then + filter=1 +fi + +################################# +# --- Main Program, DTrace --- +# +/usr/sbin/dtrace -Cs <( print -r ' + /* + * Command line arguments + */ + inline int OPT_name = '$opt_name'; + inline int OPT_pid = '$opt_pid'; + inline int OPT_time = '$opt_time'; + inline int OPT_timestr = '$opt_timestr'; + inline int OPT_zone = '$opt_zone'; + inline int OPT_proj = '$opt_proj'; + inline int PID = '$pid'; + inline int FILTER = '$filter'; + inline string NAME = "'$pname'"; + +#pragma D option quiet +#pragma D option switchrate=10hz + +#include <sys/file.h> +#include <inet/common.h> +#include <sys/byteorder.h> +#include <sys/socket.h> +#include <sys/socketvar.h> + +/* + * Print header + */ +dtrace:::BEGIN +{ + /* print optional headers */ + OPT_time ? printf("%-14s ", "TIME") : 1; + OPT_timestr ? printf("%-20s ", "STRTIME") : 1; + OPT_zone ? printf("%4s ", "ZONE") : 1; + OPT_proj ? printf("%4s ", "PROJ") : 1; + + /* print main headers */ + printf("%5s %6s %-15s %5s %2s %-15s %5s %5s %s\n", + "UID", "PID", "LADDR", "LPORT", "DR", "RADDR", "RPORT", + "SIZE", "CMD"); +} + + +/* + * TCP Process inbound connections + * + * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was + * renamed to SS_DIRECT around build 31. + */ +fbt:sockfs:sotpi_accept:entry +/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ +{ + self->sop = args[0]; +} + +fbt:sockfs:sotpi_create:return +/self->sop/ +{ + self->nsop = (struct sonode *)arg1; +} + +fbt:sockfs:sotpi_accept:return +/self->nsop/ +{ + this->tcpp = (tcp_t *)self->nsop->so_priv; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; +} + +fbt:sockfs:sotpi_accept:return +{ + self->nsop = 0; + self->sop = 0; +} + +/* + * TCP Process outbound connections + */ +fbt:ip:tcp_connect:entry +{ + this->tcpp = (tcp_t *)arg0; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; + OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1; +} + +/* + * TCP Data translations + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + /* fetch ports */ +#if defined(_BIG_ENDIAN) + self->lport = self->connp->u_port.tcpu_ports.tcpu_lport; + self->fport = self->connp->u_port.tcpu_ports.tcpu_fport; +#else + self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport); + self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport); +#endif + + /* fetch IPv4 addresses */ + this->fad12 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; + this->fad13 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; + this->fad14 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; + this->fad15 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; + this->lad12 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12]; + this->lad13 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13]; + this->lad14 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14]; + this->lad15 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15]; + + /* convert type for use with lltostr() */ + this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12; + this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13; + this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14; + this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15; + this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12; + this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13; + this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14; + this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15; + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + /* fix direction and save values */ + tladdr[(int)self->connp] = self->laddr; + tfaddr[(int)self->connp] = self->faddr; + tlport[(int)self->connp] = self->lport; + tfport[(int)self->connp] = self->fport; + + /* all systems go */ + tok[(int)self->connp] = 1; +} + +/* + * TCP Clear connp + */ +fbt:ip:tcp_get_conn:return +{ + /* Q_TO_CONN */ + this->connp = (conn_t *)arg1; + tok[(int)this->connp] = 0; + tpid[(int)this->connp] = 0; + tuid[(int)this->connp] = 0; + tname[(int)this->connp] = 0; + tproj[(int)this->connp] = 0; +} + +/* + * TCP Process "port closed" + */ +fbt:ip:tcp_xmit_early_reset:entry +/FILTER == 0/ +{ + this->queuep = args[7]->tcps_g_q; + this->connp = (conn_t *)this->queuep->q_ptr; + this->tcpp = (tcp_t *)this->connp->conn_tcp; + self->zoneid = this->connp->conn_zoneid; + + /* split addresses */ + this->ipha = (ipha_t *)args[1]->b_rptr; + this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24; + this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16; + this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8; + this->fad12 = (this->ipha->ipha_src & 0x000000ff); + this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24; + this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16; + this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8; + this->lad12 = (this->ipha->ipha_dst & 0x000000ff); + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + self->reset = 1; +} + +/* + * TCP Fetch "port closed" ports + */ +fbt:ip:tcp_xchg:entry +/self->reset/ +{ +#if defined(_BIG_ENDIAN) + self->lport = (uint16_t)arg0; + self->fport = (uint16_t)arg1; +#else + self->lport = BSWAP_16((uint16_t)arg0); + self->fport = BSWAP_16((uint16_t)arg1); +#endif + self->lport = BE16_TO_U16(arg0); + self->fport = BE16_TO_U16(arg1); +} + +/* + * TCP Print "port closed" + */ +fbt:ip:tcp_xmit_early_reset:return +/FILTER == 0/ +{ + self->name = "<closed>"; + self->pid = 0; + self->uid = 0; + self->proj = 0; + self->size = 54; /* should check trailers */ + self->dir = "<-"; + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "->"; + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->reset = 0; + self->size = 0; + self->name = 0; + self->zoneid = 0; +} + +/* + * TCP Process Write + */ +fbt:ip:tcp_send_data:entry +{ + self->conn_p = (conn_t *)args[0]->tcp_connp; +} + +fbt:ip:tcp_send_data:entry +/tok[(int)self->conn_p]/ +{ + self->dir = "->"; + self->size = msgdsize(args[2]) + 14; /* should check trailers */ + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; + self->zoneid = self->conn_p->conn_zoneid; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Process Read + */ +fbt:ip:tcp_rput_data:entry +{ + self->conn_p = (conn_t *)arg0; + self->size = msgdsize(args[1]) + 14; /* should check trailers */ +} + +fbt:ip:tcp_rput_data:entry +/tok[(int)self->conn_p]/ +{ + self->dir = "<-"; + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; + self->zoneid = self->conn_p->conn_zoneid; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Complete printing outbound handshake + */ +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->zoneid = self->connp->conn_zoneid; + OPT_proj ? self->proj = tproj[(int)self->connp] : 1; + self->size = 54; /* should check trailers */ + self->dir = "->"; +} + +fbt:ip:tcp_connect:return +/(self->connp) && + ((FILTER == 0) || + (OPT_pid && self->pid == PID) || + (OPT_name && self->name == NAME))/ +{ + /* this packet occured before connp was fully established */ + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * TCP Complete printing inbound handshake + */ +fbt:sockfs:sotpi_accept:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->zoneid = self->connp->conn_zoneid; + OPT_proj ? self->proj = tproj[(int)self->connp] : 1; + self->size = 54; /* should check trailers */ + self->dir = "<-"; +} + +fbt:sockfs:sotpi_accept:return +/(self->connp) && + ((FILTER == 0) || + (OPT_pid && self->pid == PID) || + (OPT_name && self->name == NAME))/ +{ + /* these packets occured before connp was fully established */ + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "->"; + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "<-"; + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * Print output + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +/(self->ok == 2) && + ((FILTER == 0) || + (OPT_pid && self->pid == PID) || + (OPT_name && self->name == NAME))/ +{ + /* print optional fields */ + OPT_time ? printf("%-14d ", timestamp/1000) : 1; + OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; + OPT_zone ? printf("%4d ", self->zoneid) : 1; + OPT_proj ? printf("%4d ", self->proj) : 1; + + /* print output line */ + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * TCP Clear connect variables + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->faddr = 0; + self->laddr = 0; + self->fport = 0; + self->lport = 0; + self->connp = 0; + self->name = 0; + self->pid = 0; + self->uid = 0; +} + +/* + * TCP Clear r/w variables + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +{ + self->ok = 0; + self->dir = 0; + self->uid = 0; + self->pid = 0; + self->size = 0; + self->name = 0; + self->lport = 0; + self->fport = 0; + self->laddr = 0; + self->faddr = 0; + self->conn_p = 0; + self->zoneid = 0; + self->proj = 0; +} +') diff --git a/cddl/contrib/dtracetoolkit/Net/tcpsnoop_snv.d b/cddl/contrib/dtracetoolkit/Net/tcpsnoop_snv.d new file mode 100755 index 000000000000..b696f0e46619 --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/tcpsnoop_snv.d @@ -0,0 +1,426 @@ +#!/usr/sbin/dtrace -Cs +/* + * tcpsnoop_snv.d - snoop TCP network packets by process. + * Written using DTrace (Solaris Nevada) + * + * This analyses TCP network packets and prints the responsible PID and UID, + * plus standard details such as IP address and port. This captures traffic + * of newly created TCP connections that were established while this program + * was running. It can help identify which processes is causing TCP traffic. + * + * WARNING: This script may only work on Solaris Nevada and OpenSolaris + * of the late 2007 vintage, since it uses the fbt provider to trace the raw + * operation of a specific version of the kernel. In the future, a 'stable' + * network provider should exist which will allow this to be written for that + * and subsequent versions of the kernel. In the meantime, check for other + * versions of this script in the /Net directory, and read the + * Notes/ALLfbt_notes.txt for more background on fbt. + * + * $Id: tcpsnoop_snv.d 69 2007-10-04 13:40:00Z brendan $ + * + * USAGE: tcpsnoop.d + * + * FIELDS: + * UID user ID + * PID process ID + * CMD command + * LADDR local IP address + * RADDR remote IP address + * LPORT local port number + * RPORT remote port number + * DR direction + * SIZE packet size, bytes + * + * SEE ALSO: snoop -rS + * + * COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. + * + * CDDL HEADER START + * + * The contents of this file are subject to the terms of the + * Common Development and Distribution License, Version 1.0 only + * (the "License"). You may not use this file except in compliance + * with the License. + * + * You can obtain a copy of the license at Docs/cddl1.txt + * or http://www.opensolaris.org/os/licensing. + * See the License for the specific language governing permissions + * and limitations under the License. + * + * CDDL HEADER END + * + * Author: Brendan Gregg [Sydney, Australia] + * + * TODO: IPv6 + * + * 09-Jul-2004 Brendan Gregg Created this. + * 12-Mar-2005 " " Changed probes, size info now printed. + * 02-Jul-2005 " " Many more probes. Renamed "tcpsnoop.d". + * 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct + * execname. Thanks Kias Belgaied for expertise. + * 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. + * 20-Apr-2006 " " Last update. + * 30-Sep-2007 " " Bumped this for recent OpenSolaris/Nevada. + */ + +#pragma D option quiet +#pragma D option switchrate=10hz + +#include <sys/file.h> +#include <inet/common.h> +#include <sys/byteorder.h> + +/* + * Print header + */ +dtrace:::BEGIN +{ + /* print main headers */ + printf("%5s %6s %-15s %5s %2s %-15s %5s %5s %s\n", + "UID", "PID", "LADDR", "LPORT", "DR", "RADDR", "RPORT", + "SIZE", "CMD"); +} + +/* + * TCP Process inbound connections + * + * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was + * renamed to SS_DIRECT around build 31. + */ +fbt:sockfs:sotpi_accept:entry +/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ +{ + self->sop = args[0]; +} + +fbt:sockfs:sotpi_create:return +/self->sop/ +{ + self->nsop = (struct sonode *)arg1; +} + +fbt:sockfs:sotpi_accept:return +/self->nsop/ +{ + this->tcpp = (tcp_t *)self->nsop->so_priv; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; +} + +fbt:sockfs:sotpi_accept:return +{ + self->nsop = 0; + self->sop = 0; +} + +/* + * TCP Process outbound connections + */ +fbt:ip:tcp_connect:entry +{ + this->tcpp = (tcp_t *)arg0; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; +} + +/* + * TCP Data translations + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + /* fetch ports */ +#if defined(_BIG_ENDIAN) + self->lport = self->connp->u_port.tcpu_ports.tcpu_lport; + self->fport = self->connp->u_port.tcpu_ports.tcpu_fport; +#else + self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport); + self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport); +#endif + + /* fetch IPv4 addresses */ + this->fad12 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; + this->fad13 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; + this->fad14 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; + this->fad15 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; + this->lad12 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12]; + this->lad13 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13]; + this->lad14 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14]; + this->lad15 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15]; + + /* convert type for use with lltostr() */ + this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12; + this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13; + this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14; + this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15; + this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12; + this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13; + this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14; + this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15; + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + /* fix direction and save values */ + tladdr[(int)self->connp] = self->laddr; + tfaddr[(int)self->connp] = self->faddr; + tlport[(int)self->connp] = self->lport; + tfport[(int)self->connp] = self->fport; + + /* all systems go */ + tok[(int)self->connp] = 1; +} + +/* + * TCP Clear connp + */ +fbt:ip:tcp_get_conn:return +{ + /* Q_TO_CONN */ + this->connp = (conn_t *)arg1; + tok[(int)this->connp] = 0; + tpid[(int)this->connp] = 0; + tuid[(int)this->connp] = 0; + tname[(int)this->connp] = 0; +} + +/* + * TCP Process "port closed" + */ +fbt:ip:tcp_xmit_early_reset:entry +{ + this->queuep = args[7]->tcps_g_q; + this->connp = (conn_t *)this->queuep->q_ptr; + this->tcpp = (tcp_t *)this->connp->conn_tcp; + + /* split addresses */ + this->ipha = (ipha_t *)args[1]->b_rptr; + this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24; + this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16; + this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8; + this->fad12 = (this->ipha->ipha_src & 0x000000ff); + this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24; + this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16; + this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8; + this->lad12 = (this->ipha->ipha_dst & 0x000000ff); + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + self->reset = 1; +} + +/* + * TCP Fetch "port closed" ports + */ +fbt:ip:tcp_xchg:entry +/self->reset/ +{ +#if defined(_BIG_ENDIAN) + self->lport = (uint16_t)arg0; + self->fport = (uint16_t)arg1; +#else + self->lport = BSWAP_16((uint16_t)arg0); + self->fport = BSWAP_16((uint16_t)arg1); +#endif + self->lport = BE16_TO_U16(arg0); + self->fport = BE16_TO_U16(arg1); +} + +/* + * TCP Print "port closed" + */ +fbt:ip:tcp_xmit_early_reset:return +{ + self->name = "<closed>"; + self->pid = 0; + self->uid = 0; + self->size = 54; /* should check trailers */ + self->dir = "<-"; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "->"; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->reset = 0; + self->size = 0; + self->name = 0; +} + +/* + * TCP Process Write + */ +fbt:ip:tcp_send_data:entry +{ + self->conn_p = (conn_t *)args[0]->tcp_connp; +} + +fbt:ip:tcp_send_data:entry +/tok[(int)self->conn_p]/ +{ + self->dir = "->"; + self->size = msgdsize(args[2]) + 14; /* should check trailers */ + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Process Read + */ +fbt:ip:tcp_rput_data:entry +{ + self->conn_p = (conn_t *)arg0; + self->size = msgdsize(args[1]) + 14; /* should check trailers */ +} + +fbt:ip:tcp_rput_data:entry +/tok[(int)self->conn_p]/ +{ + self->dir = "<-"; + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Complete printing outbound handshake + */ +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->size = 54; /* should check trailers */ + self->dir = "->"; + /* this packet occured before connp was fully established */ + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * TCP Complete printing inbound handshake + */ +fbt:sockfs:sotpi_accept:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->size = 54; /* should check trailers */ + /* these packets occured before connp was fully established */ + self->dir = "<-"; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "->"; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); + self->dir = "<-"; + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * Print output + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +/self->ok == 2/ +{ + /* print output line */ + printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", + self->uid, self->pid, self->laddr, self->lport, self->dir, + self->faddr, self->fport, self->size, self->name); +} + +/* + * TCP Clear connect variables + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->faddr = 0; + self->laddr = 0; + self->fport = 0; + self->lport = 0; + self->connp = 0; + self->name = 0; + self->pid = 0; + self->uid = 0; +} + +/* + * TCP Clear r/w variables + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +{ + self->ok = 0; + self->dir = 0; + self->uid = 0; + self->pid = 0; + self->size = 0; + self->name = 0; + self->lport = 0; + self->fport = 0; + self->laddr = 0; + self->faddr = 0; + self->conn_p = 0; +} diff --git a/cddl/contrib/dtracetoolkit/Net/tcpstat.d b/cddl/contrib/dtracetoolkit/Net/tcpstat.d new file mode 100755 index 000000000000..1fe40040c6d1 --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/tcpstat.d @@ -0,0 +1,91 @@ +#!/usr/sbin/dtrace -s +/* + * tcpstat.d - print TCP statistics. Uses DTrace. + * + * This prints TCP statistics every second, retrieved from the MIB provider. + * + * $Id: tcpstat.d 3 2007-08-01 10:50:08Z brendan $ + * + * USAGE: tcpstat.d + * + * FIELDS: + * TCP_out TCP bytes sent + * TCP_outRe TCP bytes retransmitted + * TCP_in TCP bytes received + * TCP_inDup TCP bytes received duplicated + * TCP_inUn TCP bytes received out of order + * + * The above TCP statistics are documented in the mib2_tcp struct + * in the /usr/include/inet/mib2.h file; and also in the mib provider + * chapter of the DTrace Guide, http://docs.sun.com/db/doc/817-6223. + * + * COPYRIGHT: Copyright (c) 2005 Brendan Gregg. + * + * CDDL HEADER START + * + * The contents of this file are subject to the terms of the + * Common Development and Distribution License, Version 1.0 only + * (the "License"). You may not use this file except in compliance + * with the License. + * + * You can obtain a copy of the license at Docs/cddl1.txt + * or http://www.opensolaris.org/os/licensing. + * See the License for the specific language governing permissions + * and limitations under the License. + * + * CDDL HEADER END + * + * 15-May-2005 Brendan Gregg Created this. + * 15-May-2005 " " Last update. + */ + +#pragma D option quiet + +/* + * Declare Globals + */ +dtrace:::BEGIN +{ + TCP_out = 0; TCP_outRe = 0; + TCP_in = 0; TCP_inDup = 0; TCP_inUn = 0; + LINES = 20; line = 0; +} + +/* + * Print Header + */ +profile:::tick-1sec { line--; } + +profile:::tick-1sec +/line <= 0 / +{ + printf("%11s %11s %11s %11s %11s\n", + "TCP_out", "TCP_outRe", "TCP_in", "TCP_inDup", "TCP_inUn"); + + line = LINES; +} + +/* + * Save Data + */ +mib:::tcpOutDataBytes { TCP_out += arg0; } +mib:::tcpRetransBytes { TCP_outRe += arg0; } +mib:::tcpInDataInorderBytes { TCP_in += arg0; } +mib:::tcpInDataDupBytes { TCP_inDup += arg0; } +mib:::tcpInDataUnorderBytes { TCP_inUn += arg0; } + +/* + * Print Output + */ +profile:::tick-1sec +{ + printf("%11d %11d %11d %11d %11d\n", + TCP_out, TCP_outRe, TCP_in, TCP_inDup, TCP_inUn); + + /* clear values */ + TCP_out = 0; + TCP_outRe = 0; + TCP_in = 0; + TCP_inDup = 0; + TCP_inUn = 0; +} diff --git a/cddl/contrib/dtracetoolkit/Net/tcptop b/cddl/contrib/dtracetoolkit/Net/tcptop new file mode 100755 index 000000000000..70b6e6f3176e --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/tcptop @@ -0,0 +1,579 @@ +#!/usr/bin/ksh +# +# tcptop - display top TCP network packets by process. +# Written using DTrace (Solaris 10 3/05) +# +# This analyses TCP network packets and prints the responsible PID and UID, +# plus standard details such as IP address and port. This captures traffic +# of newly created TCP connections that were established while this program +# was running. It can help identify which processes is causing TCP traffic. +# +# WARNING: This script may only work on Solaris 10 3/05, since it uses the +# fbt provider to trace the raw operation of a specific version of the kernel. +# In the future, a 'stable' network provider should exist which will allow +# this to be written for that and subsequent versions of the kernel. In the +# meantime, check for other versions of this script in the /Net directory, +# and read the Notes/ALLfbt_notes.txt for more background on fbt. +# +# $Id: tcptop 69 2007-10-04 13:40:00Z brendan $ +# +# USAGE: tcptop [-Ch] [-j|-Z] [interval [count]] +# +# -C # don't clear the screen +# -j # print project IDs +# -Z # print zone IDs +# +# FIELDS: +# UID user ID +# PID process ID +# CMD command +# LADDR local IP address +# RADDR remote IP address +# LPORT local port number +# RPORT remote port number +# SIZE packet size, bytes +# load 1 min load average +# TCPin TCP inbound payload data +# TCPout TCP outbound payload data +# ZONE zone ID +# PROJ project ID +# +# SEE ALSO: tcpsnoop +# +# COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. +# +# CDDL HEADER START +# +# The contents of this file are subject to the terms of the +# Common Development and Distribution License, Version 1.0 only +# (the "License"). You may not use this file except in compliance +# with the License. +# +# You can obtain a copy of the license at Docs/cddl1.txt +# or http://www.opensolaris.org/os/licensing. +# See the License for the specific language governing permissions +# and limitations under the License. +# +# CDDL HEADER END +# +# Author: Brendan Gregg [Sydney, Australia] +# +# ToDo: IPv6 +# +# 05-Jul-2005 Brendan Gregg Created this. +# 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct +# execname. Thanks Kias Belgaied for expertise. +# 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. +# 20-Apr-2006 " " Last update. +# + +############################## +# --- Process Arguments --- +# + +### default variables +opt_def=1; opt_clear=1; opt_zone=0; opt_proj=0; interval=5; count=-1 + +### process options +while getopts ChjZ name +do + case $name in + C) opt_clear=0 ;; + j) opt_proj=1; opt_def=0 ;; + Z) opt_zone=1; opt_def=0 ;; + h|?) cat <<-END >&2 + USAGE: tcptop [-h] [-j|-Z] [interval [count]] + tcptop # default output + -C # don't clear the screen + -j # print project ID + -Z # print zonename + eg, + tcptop # default is 5 sec interval + tcptop 2 # 2 second interval + tcptop -C 1 10 # 10 x 1 sec samples, no clear + END + exit 1 + esac +done +shift $(( $OPTIND - 1 )) + +### option logic +if [[ "$1" > 0 ]]; then + interval=$1; shift +fi +if [[ "$1" > 0 ]]; then + count=$1; shift +fi +if (( opt_proj && opt_zone )); then + opt_proj=0 +fi +if (( opt_clear )); then + clearstr=`clear` +else + clearstr=. +fi + +################################# +# --- Main Program, DTrace --- +# +/usr/sbin/dtrace -Cs <( print -r ' + /* + * Command line arguments + */ + inline int OPT_def = '$opt_def'; + inline int OPT_zone = '$opt_zone'; + inline int OPT_proj = '$opt_proj'; + inline int OPT_clear = '$opt_clear'; + inline int INTERVAL = '$interval'; + inline int COUNTER = '$count'; + inline string CLEAR = "'$clearstr'"; + +#pragma D option quiet +#pragma D option switchrate=10hz + +#include <sys/file.h> +#include <inet/common.h> +#include <sys/byteorder.h> +#include <sys/socket.h> +#include <sys/socketvar.h> + +/* + * Print header + */ +dtrace:::BEGIN +{ + /* starting values */ + counts = COUNTER; + secs = INTERVAL; + TCP_out = 0; + TCP_in = 0; + + printf("Tracing... Please wait.\n"); +} + +/* + * TCP Process inbound connections + * + * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was + * renamed to SS_DIRECT around build 31. + */ +fbt:sockfs:sotpi_accept:entry +/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ +{ + self->sop = args[0]; +} + +fbt:sockfs:sotpi_create:return +/self->sop/ +{ + self->nsop = (struct sonode *)arg1; +} + +fbt:sockfs:sotpi_accept:return +/self->nsop/ +{ + this->tcpp = (tcp_t *)self->nsop->so_priv; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; +} + +fbt:sockfs:sotpi_accept:return +{ + self->nsop = 0; + self->sop = 0; +} + +/* + * TCP Process outbound connections + */ +fbt:ip:tcp_connect:entry +{ + this->tcpp = (tcp_t *)arg0; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; + OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1; +} + +/* + * TCP Data translations + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + /* fetch ports */ +#if defined(_BIG_ENDIAN) + self->lport = self->connp->u_port.tcpu_ports.tcpu_lport; + self->fport = self->connp->u_port.tcpu_ports.tcpu_fport; +#else + self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport); + self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport); +#endif + + /* fetch IPv4 addresses */ + this->fad12 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; + this->fad13 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; + this->fad14 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; + this->fad15 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; + this->lad12 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12]; + this->lad13 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13]; + this->lad14 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14]; + this->lad15 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15]; + + /* convert type for use with lltostr() */ + this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12; + this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13; + this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14; + this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15; + this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12; + this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13; + this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14; + this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15; + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + /* fix direction and save values */ + tladdr[(int)self->connp] = self->laddr; + tfaddr[(int)self->connp] = self->faddr; + tlport[(int)self->connp] = self->lport; + tfport[(int)self->connp] = self->fport; + + /* all systems go */ + tok[(int)self->connp] = 1; +} + +/* + * TCP Clear connp + */ +fbt:ip:tcp_get_conn:return +{ + /* Q_TO_CONN */ + this->connp = (conn_t *)arg1; + tok[(int)this->connp] = 0; + tpid[(int)this->connp] = 0; + tuid[(int)this->connp] = 0; + tname[(int)this->connp] = 0; + tproj[(int)this->connp] = 0; +} + +/* + * TCP Process "port closed" + */ +fbt:ip:tcp_xmit_early_reset:entry +{ + this->queuep = (queue_t *)`tcp_g_q; /* ` */ + this->connp = (conn_t *)this->queuep->q_ptr; + this->tcpp = (tcp_t *)this->connp->conn_tcp; + self->zoneid = this->connp->conn_zoneid; + + /* split addresses */ + this->ipha = (ipha_t *)args[1]->b_rptr; + this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24; + this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16; + this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8; + this->fad12 = (this->ipha->ipha_src & 0x000000ff); + this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24; + this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16; + this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8; + this->lad12 = (this->ipha->ipha_dst & 0x000000ff); + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + self->reset = 1; +} + +/* + * TCP Fetch "port closed" ports + */ +fbt:ip:tcp_xchg:entry +/self->reset/ +{ +#if defined(_BIG_ENDIAN) + self->lport = (uint16_t)arg0; + self->fport = (uint16_t)arg1; +#else + self->lport = BSWAP_16((uint16_t)arg0); + self->fport = BSWAP_16((uint16_t)arg1); +#endif + self->lport = BE16_TO_U16(arg0); + self->fport = BE16_TO_U16(arg1); +} + +/* + * TCP Print "port closed" + */ +fbt:ip:tcp_xmit_early_reset:return +{ + self->name = "<closed>"; + self->pid = 0; + self->uid = 0; + self->proj = 0; + self->size = 54 * 2; /* should check trailers */ + OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + self->reset = 0; + self->size = 0; + self->name = 0; +} + +/* + * TCP Process Write + */ +fbt:ip:tcp_send_data:entry +{ + self->conn_p = (conn_t *)args[0]->tcp_connp; +} + +fbt:ip:tcp_send_data:entry +/tok[(int)self->conn_p]/ +{ + self->size = msgdsize(args[2]) + 14; /* should check trailers */ + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; + self->zoneid = self->conn_p->conn_zoneid; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Process Read + */ +fbt:ip:tcp_rput_data:entry +{ + self->conn_p = (conn_t *)arg0; + self->size = msgdsize(args[1]) + 14; /* should check trailers */ +} + +fbt:ip:tcp_rput_data:entry +/tok[(int)self->conn_p]/ +{ + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; + self->zoneid = self->conn_p->conn_zoneid; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Complete printing outbound handshake + */ +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->zoneid = self->connp->conn_zoneid; + OPT_proj ? self->proj = tproj[(int)self->connp] : 1; + self->size = 54; /* should check trailers */ + + /* this packet occured before connp was fully established */ + OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; +} + +/* + * TCP Complete printing inbound handshake + */ +fbt:sockfs:sotpi_accept:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->zoneid = self->connp->conn_zoneid; + OPT_proj ? self->proj = tproj[(int)self->connp] : 1; + self->size = 54 * 3; /* should check trailers */ + + /* these packets occured before connp was fully established */ + OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; +} + +/* + * TCP Save data + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +/self->ok == 2/ +{ + /* save r+w data*/ + OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; +} + +/* + * TCP Clear connect variables + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->faddr = 0; + self->laddr = 0; + self->fport = 0; + self->lport = 0; + self->connp = 0; + self->name = 0; + self->pid = 0; + self->uid = 0; +} + +/* + * TCP Clear r/w variables + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +{ + self->ok = 0; + self->uid = 0; + self->pid = 0; + self->size = 0; + self->name = 0; + self->lport = 0; + self->fport = 0; + self->laddr = 0; + self->faddr = 0; + self->conn_p = 0; + self->zoneid = 0; + self->proj = 0; +} + +/* + * TCP Systemwide Stats + */ +mib:::tcpOutDataBytes { TCP_out += args[0]; } +mib:::tcpRetransBytes { TCP_out += args[0]; } +mib:::tcpInDataInorderBytes { TCP_in += args[0]; } +mib:::tcpInDataDupBytes { TCP_in += args[0]; } +mib:::tcpInDataUnorderBytes { TCP_in += args[0]; } + +/* + * Timer + */ +profile:::tick-1sec +{ + secs--; +} + +/* + * Print Report + */ +profile:::tick-1sec +/secs == 0/ +{ + /* fetch 1 min load average */ + this->load1a = `hp_avenrun[0] / 65536; + this->load1b = ((`hp_avenrun[0] % 65536) * 100) / 65536; + + /* convert TCP counters to Kbytes */ + TCP_out /= 1024; + TCP_in /= 1024; + + /* print status */ + OPT_clear ? printf("%s", CLEAR) : 1; + printf("%Y, load: %d.%02d, TCPin: %6d KB, TCPout: %6d KB\n\n", + walltimestamp, this->load1a, this->load1b, TCP_in, TCP_out); + + /* print headers */ + OPT_def ? printf(" UID ") : 1; + OPT_proj ? printf("PROJ ") : 1; + OPT_zone ? printf("ZONE ") : 1; + printf("%6s %-15s %5s %-15s %5s %9s %s\n", + "PID", "LADDR", "LPORT", "RADDR", "RPORT", "SIZE", "NAME"); + + /* print data */ + printa("%4d %6d %-15s %5d %-15s %5d %@9d %s\n", @out); + printf("\n"); + + /* clear data */ + trunc(@out); + TCP_in = 0; + TCP_out = 0; + secs = INTERVAL; + counts--; +} + +/* + * End of program + */ +profile:::tick-1sec +/counts == 0/ +{ + exit(0); +} + +/* + * Cleanup for Ctrl-C + */ +dtrace:::END +{ + trunc(@out); +} +') diff --git a/cddl/contrib/dtracetoolkit/Net/tcptop_snv b/cddl/contrib/dtracetoolkit/Net/tcptop_snv new file mode 100755 index 000000000000..56714e3c01f4 --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/tcptop_snv @@ -0,0 +1,581 @@ +#!/usr/bin/ksh +# +# tcptop_snv - display top TCP network packets by process. +# Written using DTrace (Solaris Nevada) +# +# This analyses TCP network packets and prints the responsible PID and UID, +# plus standard details such as IP address and port. This captures traffic +# of newly created TCP connections that were established while this program +# was running. It can help identify which processes is causing TCP traffic. +# +# WARNING: This script may only work on Solaris Nevada and OpenSolaris +# of the late 2007 vintage, since it uses the fbt provider to trace the raw +# operation of a specific version of the kernel. In the future, a 'stable' +# network provider should exist which will allow this to be written for that +# and subsequent versions of the kernel. In the meantime, check for other +# versions of this script in the /Net directory, and read the +# Notes/ALLfbt_notes.txt for more background on fbt. +# +# $Id: tcptop_snv 69 2007-10-04 13:40:00Z brendan $ +# +# USAGE: tcptop [-Ch] [-j|-Z] [interval [count]] +# +# -C # don't clear the screen +# -j # print project IDs +# -Z # print zone IDs +# +# FIELDS: +# UID user ID +# PID process ID +# CMD command +# LADDR local IP address +# RADDR remote IP address +# LPORT local port number +# RPORT remote port number +# SIZE packet size, bytes +# load 1 min load average +# TCPin TCP inbound payload data +# TCPout TCP outbound payload data +# ZONE zone ID +# PROJ project ID +# +# SEE ALSO: tcpsnoop +# +# COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. +# +# CDDL HEADER START +# +# The contents of this file are subject to the terms of the +# Common Development and Distribution License, Version 1.0 only +# (the "License"). You may not use this file except in compliance +# with the License. +# +# You can obtain a copy of the license at Docs/cddl1.txt +# or http://www.opensolaris.org/os/licensing. +# See the License for the specific language governing permissions +# and limitations under the License. +# +# CDDL HEADER END +# +# Author: Brendan Gregg [Sydney, Australia] +# +# ToDo: IPv6 +# +# 05-Jul-2005 Brendan Gregg Created this. +# 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct +# execname. Thanks Kias Belgaied for expertise. +# 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. +# 20-Apr-2006 " " Last update. +# 30-Sep-2007 " " Bumped this for recent OpenSolaris/Nevada. +# + +############################## +# --- Process Arguments --- +# + +### default variables +opt_def=1; opt_clear=1; opt_zone=0; opt_proj=0; interval=5; count=-1 + +### process options +while getopts ChjZ name +do + case $name in + C) opt_clear=0 ;; + j) opt_proj=1; opt_def=0 ;; + Z) opt_zone=1; opt_def=0 ;; + h|?) cat <<-END >&2 + USAGE: tcptop [-h] [-j|-Z] [interval [count]] + tcptop # default output + -C # don't clear the screen + -j # print project ID + -Z # print zonename + eg, + tcptop # default is 5 sec interval + tcptop 2 # 2 second interval + tcptop -C 1 10 # 10 x 1 sec samples, no clear + END + exit 1 + esac +done +shift $(( $OPTIND - 1 )) + +### option logic +if [[ "$1" > 0 ]]; then + interval=$1; shift +fi +if [[ "$1" > 0 ]]; then + count=$1; shift +fi +if (( opt_proj && opt_zone )); then + opt_proj=0 +fi +if (( opt_clear )); then + clearstr=`clear` +else + clearstr=. +fi + +################################# +# --- Main Program, DTrace --- +# +/usr/sbin/dtrace -Cs <( print -r ' + /* + * Command line arguments + */ + inline int OPT_def = '$opt_def'; + inline int OPT_zone = '$opt_zone'; + inline int OPT_proj = '$opt_proj'; + inline int OPT_clear = '$opt_clear'; + inline int INTERVAL = '$interval'; + inline int COUNTER = '$count'; + inline string CLEAR = "'$clearstr'"; + +#pragma D option quiet +#pragma D option switchrate=10hz + +#include <sys/file.h> +#include <inet/common.h> +#include <sys/byteorder.h> +#include <sys/socket.h> +#include <sys/socketvar.h> + +/* + * Print header + */ +dtrace:::BEGIN +{ + /* starting values */ + counts = COUNTER; + secs = INTERVAL; + TCP_out = 0; + TCP_in = 0; + + printf("Tracing... Please wait.\n"); +} + +/* + * TCP Process inbound connections + * + * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was + * renamed to SS_DIRECT around build 31. + */ +fbt:sockfs:sotpi_accept:entry +/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ +{ + self->sop = args[0]; +} + +fbt:sockfs:sotpi_create:return +/self->sop/ +{ + self->nsop = (struct sonode *)arg1; +} + +fbt:sockfs:sotpi_accept:return +/self->nsop/ +{ + this->tcpp = (tcp_t *)self->nsop->so_priv; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; +} + +fbt:sockfs:sotpi_accept:return +{ + self->nsop = 0; + self->sop = 0; +} + +/* + * TCP Process outbound connections + */ +fbt:ip:tcp_connect:entry +{ + this->tcpp = (tcp_t *)arg0; + self->connp = (conn_t *)this->tcpp->tcp_connp; + tname[(int)self->connp] = execname; + tpid[(int)self->connp] = pid; + tuid[(int)self->connp] = uid; + OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1; +} + +/* + * TCP Data translations + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + /* fetch ports */ +#if defined(_BIG_ENDIAN) + self->lport = self->connp->u_port.tcpu_ports.tcpu_lport; + self->fport = self->connp->u_port.tcpu_ports.tcpu_fport; +#else + self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport); + self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport); +#endif + + /* fetch IPv4 addresses */ + this->fad12 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; + this->fad13 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; + this->fad14 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; + this->fad15 = + (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; + this->lad12 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12]; + this->lad13 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13]; + this->lad14 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14]; + this->lad15 = + (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15]; + + /* convert type for use with lltostr() */ + this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12; + this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13; + this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14; + this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15; + this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12; + this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13; + this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14; + this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15; + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + /* fix direction and save values */ + tladdr[(int)self->connp] = self->laddr; + tfaddr[(int)self->connp] = self->faddr; + tlport[(int)self->connp] = self->lport; + tfport[(int)self->connp] = self->fport; + + /* all systems go */ + tok[(int)self->connp] = 1; +} + +/* + * TCP Clear connp + */ +fbt:ip:tcp_get_conn:return +{ + /* Q_TO_CONN */ + this->connp = (conn_t *)arg1; + tok[(int)this->connp] = 0; + tpid[(int)this->connp] = 0; + tuid[(int)this->connp] = 0; + tname[(int)this->connp] = 0; + tproj[(int)this->connp] = 0; +} + +/* + * TCP Process "port closed" + */ +fbt:ip:tcp_xmit_early_reset:entry +{ + this->queuep = args[7]->tcps_g_q; + this->connp = (conn_t *)this->queuep->q_ptr; + this->tcpp = (tcp_t *)this->connp->conn_tcp; + self->zoneid = this->connp->conn_zoneid; + + /* split addresses */ + this->ipha = (ipha_t *)args[1]->b_rptr; + this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24; + this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16; + this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8; + this->fad12 = (this->ipha->ipha_src & 0x000000ff); + this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24; + this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16; + this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8; + this->lad12 = (this->ipha->ipha_dst & 0x000000ff); + + /* stringify addresses */ + self->faddr = strjoin(lltostr(this->fad12), "."); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); + self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); + self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); + self->laddr = strjoin(lltostr(this->lad12), "."); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); + self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); + self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); + + self->reset = 1; +} + +/* + * TCP Fetch "port closed" ports + */ +fbt:ip:tcp_xchg:entry +/self->reset/ +{ +#if defined(_BIG_ENDIAN) + self->lport = (uint16_t)arg0; + self->fport = (uint16_t)arg1; +#else + self->lport = BSWAP_16((uint16_t)arg0); + self->fport = BSWAP_16((uint16_t)arg1); +#endif + self->lport = BE16_TO_U16(arg0); + self->fport = BE16_TO_U16(arg1); +} + +/* + * TCP Print "port closed" + */ +fbt:ip:tcp_xmit_early_reset:return +{ + self->name = "<closed>"; + self->pid = 0; + self->uid = 0; + self->proj = 0; + self->size = 54 * 2; /* should check trailers */ + OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + self->reset = 0; + self->size = 0; + self->name = 0; +} + +/* + * TCP Process Write + */ +fbt:ip:tcp_send_data:entry +{ + self->conn_p = (conn_t *)args[0]->tcp_connp; +} + +fbt:ip:tcp_send_data:entry +/tok[(int)self->conn_p]/ +{ + self->size = msgdsize(args[2]) + 14; /* should check trailers */ + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; + self->zoneid = self->conn_p->conn_zoneid; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Process Read + */ +fbt:ip:tcp_rput_data:entry +{ + self->conn_p = (conn_t *)arg0; + self->size = msgdsize(args[1]) + 14; /* should check trailers */ +} + +fbt:ip:tcp_rput_data:entry +/tok[(int)self->conn_p]/ +{ + self->uid = tuid[(int)self->conn_p]; + self->laddr = tladdr[(int)self->conn_p]; + self->faddr = tfaddr[(int)self->conn_p]; + self->lport = tlport[(int)self->conn_p]; + self->fport = tfport[(int)self->conn_p]; + OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; + self->zoneid = self->conn_p->conn_zoneid; + self->ok = 2; + + /* follow inetd -> in.* transitions */ + self->name = pid && (tname[(int)self->conn_p] == "inetd") ? + execname : tname[(int)self->conn_p]; + self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? + pid : tpid[(int)self->conn_p]; + tname[(int)self->conn_p] = self->name; + tpid[(int)self->conn_p] = self->pid; +} + +/* + * TCP Complete printing outbound handshake + */ +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->zoneid = self->connp->conn_zoneid; + OPT_proj ? self->proj = tproj[(int)self->connp] : 1; + self->size = 54; /* should check trailers */ + + /* this packet occured before connp was fully established */ + OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; +} + +/* + * TCP Complete printing inbound handshake + */ +fbt:sockfs:sotpi_accept:return +/self->connp/ +{ + self->name = tname[(int)self->connp]; + self->pid = tpid[(int)self->connp]; + self->uid = tuid[(int)self->connp]; + self->zoneid = self->connp->conn_zoneid; + OPT_proj ? self->proj = tproj[(int)self->connp] : 1; + self->size = 54 * 3; /* should check trailers */ + + /* these packets occured before connp was fully established */ + OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; +} + +/* + * TCP Save data + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +/self->ok == 2/ +{ + /* save r+w data*/ + OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; + OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, + self->faddr, self->fport, self->name] = sum(self->size) : 1; +} + +/* + * TCP Clear connect variables + */ +fbt:sockfs:sotpi_accept:return, +fbt:ip:tcp_connect:return +/self->connp/ +{ + self->faddr = 0; + self->laddr = 0; + self->fport = 0; + self->lport = 0; + self->connp = 0; + self->name = 0; + self->pid = 0; + self->uid = 0; +} + +/* + * TCP Clear r/w variables + */ +fbt:ip:tcp_send_data:entry, +fbt:ip:tcp_rput_data:entry +{ + self->ok = 0; + self->uid = 0; + self->pid = 0; + self->size = 0; + self->name = 0; + self->lport = 0; + self->fport = 0; + self->laddr = 0; + self->faddr = 0; + self->conn_p = 0; + self->zoneid = 0; + self->proj = 0; +} + +/* + * TCP Systemwide Stats + */ +mib:::tcpOutDataBytes { TCP_out += args[0]; } +mib:::tcpRetransBytes { TCP_out += args[0]; } +mib:::tcpInDataInorderBytes { TCP_in += args[0]; } +mib:::tcpInDataDupBytes { TCP_in += args[0]; } +mib:::tcpInDataUnorderBytes { TCP_in += args[0]; } + +/* + * Timer + */ +profile:::tick-1sec +{ + secs--; +} + +/* + * Print Report + */ +profile:::tick-1sec +/secs == 0/ +{ + /* fetch 1 min load average */ + this->load1a = `hp_avenrun[0] / 65536; + this->load1b = ((`hp_avenrun[0] % 65536) * 100) / 65536; + + /* convert TCP counters to Kbytes */ + TCP_out /= 1024; + TCP_in /= 1024; + + /* print status */ + OPT_clear ? printf("%s", CLEAR) : 1; + printf("%Y, load: %d.%02d, TCPin: %6d KB, TCPout: %6d KB\n\n", + walltimestamp, this->load1a, this->load1b, TCP_in, TCP_out); + + /* print headers */ + OPT_def ? printf(" UID ") : 1; + OPT_proj ? printf("PROJ ") : 1; + OPT_zone ? printf("ZONE ") : 1; + printf("%6s %-15s %5s %-15s %5s %9s %s\n", + "PID", "LADDR", "LPORT", "RADDR", "RPORT", "SIZE", "NAME"); + + /* print data */ + printa("%4d %6d %-15s %5d %-15s %5d %@9d %s\n", @out); + printf("\n"); + + /* clear data */ + trunc(@out); + TCP_in = 0; + TCP_out = 0; + secs = INTERVAL; + counts--; +} + +/* + * End of program + */ +profile:::tick-1sec +/counts == 0/ +{ + exit(0); +} + +/* + * Cleanup for Ctrl-C + */ +dtrace:::END +{ + trunc(@out); +} +') diff --git a/cddl/contrib/dtracetoolkit/Net/tcpwdist.d b/cddl/contrib/dtracetoolkit/Net/tcpwdist.d new file mode 100755 index 000000000000..20753c182f60 --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/tcpwdist.d @@ -0,0 +1,82 @@ +#!/usr/sbin/dtrace -s +/* + * tcpwdist.d - simple TCP write distribution by process. + * Written in DTrace (Solaris 10 3/05). + * + * This measures the size of writes from applications to the TCP level, which + * may well be much larger than the MTU size (this is application writes not + * packet writes). It can help identify which process is creating network + * traffic, and the size of the writes by that application. It uses a simple + * probe that produces meaningful output for most protocols. + * + * Tracking TCP activity by process is complex for a number of reasons, + * the greatest is that inbound TCP traffic is asynchronous to the process. + * The easiest TCP traffic to match is writes, which this script demonstrates. + * However there are still issues - for an inbound telnet connection the + * writes are associated with the command, for example "ls -l", not something + * meaningful such as "in.telnetd". + * + * Scripts that match TCP traffic properly include tcpsnoop and tcptop. + * + * $Id: tcpwdist.d 3 2007-08-01 10:50:08Z brendan $ + * + * USAGE: tcpwdist.d # wait several seconds, then hit Ctrl-C + * + * FIELDS: + * PID process ID + * CMD command and argument list + * value TCP write payload size in bytes + * count number of writes + * + * SEE ALSO: tcpsnoop, tcptop + * + * COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. + * + * CDDL HEADER START + * + * The contents of this file are subject to the terms of the + * Common Development and Distribution License, Version 1.0 only + * (the "License"). You may not use this file except in compliance + * with the License. + * + * You can obtain a copy of the license at Docs/cddl1.txt + * or http://www.opensolaris.org/os/licensing. + * See the License for the specific language governing permissions + * and limitations under the License. + * + * CDDL HEADER END + * + * 09-Jul-2004 Brendan Gregg Created this. + * 14-Jun-2005 " " Rewrote this as tcpwdist.d. + * 20-Apr-2006 " " Last update. + */ + +#pragma D option quiet + +/* + * Print header + */ +dtrace:::BEGIN +{ + printf("Tracing... Hit Ctrl-C to end.\n"); +} + +/* + * Process TCP Write + */ +fbt:ip:tcp_output:entry +{ + /* fetch details */ + this->size = msgdsize(args[1]); + + /* store details */ + @Size[pid, curpsinfo->pr_psargs] = quantize(this->size); +} + +/* + * Print final report + */ +dtrace:::END +{ + printa(" PID: %-6d CMD: %S\n%@d\n", @Size); +} diff --git a/cddl/contrib/dtracetoolkit/Net/udpstat.d b/cddl/contrib/dtracetoolkit/Net/udpstat.d new file mode 100755 index 000000000000..7b27e4ec0b89 --- /dev/null +++ b/cddl/contrib/dtracetoolkit/Net/udpstat.d @@ -0,0 +1,92 @@ +#!/usr/sbin/dtrace -s +/* + * udpstat.d - print UDP statistics. Uses DTrace. + * + * This prints UDP statistics every second, retrieved from the MIB provider. + * + * $Id: udpstat.d 59 2007-10-03 08:21:58Z brendan $ + * + * USAGE: udpstat.d + * + * FIELDS: + * UDP_out UDP datagrams sent + * UDP_outErr UDP datagrams errored on send + * UDP_in UDP datagrams received + * UDP_inErr UDP datagrams undeliverable + * UDP_noPort UDP datagrams received to closed ports + * + * The above UDP statistics are documented in the mib2_udp struct + * in the /usr/include/inet/mib2.h file; and also in the mib provider + * chapter of the DTrace Guide, http://docs.sun.com/db/doc/817-6223. + * + * COPYRIGHT: Copyright (c) 2005 Brendan Gregg. + * + * CDDL HEADER START + * + * The contents of this file are subject to the terms of the + * Common Development and Distribution License, Version 1.0 only + * (the "License"). You may not use this file except in compliance + * with the License. + * + * You can obtain a copy of the license at Docs/cddl1.txt + * or http://www.opensolaris.org/os/licensing. + * See the License for the specific language governing permissions + * and limitations under the License. + * + * CDDL HEADER END + * + * 25-Jul-2005 Brendan Gregg Created this. + * 25-Jul-2005 " " Last update. + */ + +#pragma D option quiet + +/* + * Declare Globals + */ +dtrace:::BEGIN +{ + UDP_in = 0; UDP_out = 0; + UDP_inErr = 0; UDP_outErr = 0; UDP_noPort = 0; + LINES = 20; line = 0; +} + +/* + * Print Header + */ +profile:::tick-1sec { line--; } + +profile:::tick-1sec +/line <= 0 / +{ + printf("%11s %11s %11s %11s %11s\n", + "UDP_out", "UDP_outErr", "UDP_in", "UDP_inErr", "UDP_noPort"); + + line = LINES; +} + +/* + * Save Data + */ +mib:::udp*InDatagrams { UDP_in += arg0; } +mib:::udp*OutDatagrams { UDP_out += arg0; } +mib:::udpInErrors { UDP_inErr += arg0; } +mib:::udpInCksumErrs { UDP_inErr += arg0; } +mib:::udpOutErrors { UDP_outErr += arg0; } +mib:::udpNoPorts { UDP_noPort += arg0; } + +/* + * Print Output + */ +profile:::tick-1sec +{ + printf("%11d %11d %11d %11d %11d\n", + UDP_out, UDP_outErr, UDP_in, UDP_inErr, UDP_noPort); + + /* clear values */ + UDP_out = 0; + UDP_outErr = 0; + UDP_in = 0; + UDP_inErr = 0; + UDP_noPort = 0; +} |