Instantly share code, notes, and snippets.

Embed
What would you like to do?
probe begin {
printf("time (us) \tacceptq\tqmax\tlocal addr\tremote_addr\n")
}
function skb_get_remote_v4addr:string(skb:long)
{
return format_ipaddr(__ip_skb_daddr(__get_skb_iphdr(skb)), 2 /* AF_INET */)
}
function skb_get_remote_port:long(skb:long)
{
return __tcp_skb_sport(__get_skb_tcphdr(skb))
}
// If sk_ack_backlog is larger than sk_max_ack_backlog,
// the probe will print them and src_addr, src_port, dst_addr, dst_port
probe kernel.function("tcp_v4_conn_request") {
if ($sk->sk_ack_backlog > $sk->sk_max_ack_backlog) {
printf("%d\t%d\t%d\t%s:%d\t%s:%d\n",
gettimeofday_us(),
$sk->sk_ack_backlog,
$sk->sk_max_ack_backlog,
inet_get_ip_source($sk),
inet_get_local_port($sk),
skb_get_remote_v4addr($skb),
skb_get_remote_port($skb));
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment