from bcc import BPF
from bcc.utils import printb
def ntoa(addr):
…(省略)
def print_event(cpu, data, size):
event = bpf["events"].event(data)
printb(b"%-6d %-16s %-16s %-16s %-16d" % (event.pid, event.comm, ntoa(event.saddr), ntoa(event.daddr), event.dport))
bpf = BPF(src_file = "trace.c");
bpf.attach_kprobe(event = "tcp_v4_connect", fn_name = "tcp_connect")
bpf.attach_kretprobe(event = "tcp_v4_connect", fn_name = "tcp_connect_ret")
bpf["events"].open_perf_buffer(print_event)
print("%-6s %-16s %-16s %-16s %-16s" % ("PID", "COMMAND", "SOURCE-IPADDR", "DESTINATION-IPADDR", "DPORT"))
while 1:
bpf.perf_buffer_poll()
attach_kprobeを使って, tcp_v4_connectがreturnされた時に BPFプログラムのtcp_connect_retが 呼び出すように関連付けする