Skip to content

Instantly share code, notes, and snippets.

@akostrikov
Created May 8, 2023 09:38
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save akostrikov/6587d6de8714178d5ca5f8cda5134b17 to your computer and use it in GitHub Desktop.
Save akostrikov/6587d6de8714178d5ca5f8cda5134b17 to your computer and use it in GitHub Desktop.
Print kernel stack for packet drop and consume
#!/usr/bin/env bpftrace
//IP_ADDRESS_DST_TO_CONVERT=127.0.0.3
//IP_ADDRESS_SRC_TO_CONVERT=127.0.0.1
//DST_HTON=$(python3 -c "import ipaddress; import socket;print(socket.htonl(int(ipaddress.ip_address('$IP_ADDRESS_DST_TO_CONVERT'))))")
//SRC_HTON=$(python3 -c "import ipaddress; import socket;print(socket.htonl(int(ipaddress.ip_address('$IP_ADDRESS_SRC_TO_CONVERT'))))")
//sudo ./drop.bt $DST_HTON $SRC_HTON
//ping 127.0.0.3
//curl 127.0.0.3
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/byteorder/generic.h>
BEGIN
{
printf("Trace kernel packet drops\n");
}
kprobe:kfree_skb
{
$skb = (struct sk_buff*) arg0;
$ipheader = ((struct iphdr *) ($skb->head + $skb->network_header));
$version = ($ipheader->version) ;
if ($version == 4 && $ipheader->daddr == $1 && $ipheader->saddr == $2) {
print(kstack);
printf("[%d] %d\t%s > %s ; %ul\n", $version, $ipheader->protocol, ntop($ipheader->saddr), ntop($ipheader->daddr), $ipheader->saddr);
}
}
kprobe:consume_skb
{
$skb = (struct sk_buff*) arg0;
$ipheader = ((struct iphdr *) ($skb->head + $skb->network_header));
$version = ($ipheader->version) ;
if ($version == 4 && $ipheader->daddr == $1 && $ipheader->saddr == $2) {
print(kstack);
printf("[%d] %d\t%s > %s ; %ul\n", $version, $ipheader->protocol, ntop($ipheader->saddr), ntop($ipheader->daddr), $ipheader->saddr);
}
}
END
{
printf("Tracing of drops done.\n");
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment