1#!/usr/sbin/dtrace -Cs 2/* 3 * tcpsnoop_snv.d - snoop TCP network packets by process. 4 * Written using DTrace (Solaris Nevada) 5 * 6 * This analyses TCP network packets and prints the responsible PID and UID, 7 * plus standard details such as IP address and port. This captures traffic 8 * of newly created TCP connections that were established while this program 9 * was running. It can help identify which processes is causing TCP traffic. 10 * 11 * WARNING: This script may only work on Solaris Nevada and OpenSolaris 12 * of the late 2007 vintage, since it uses the fbt provider to trace the raw 13 * operation of a specific version of the kernel. In the future, a 'stable' 14 * network provider should exist which will allow this to be written for that 15 * and subsequent versions of the kernel. In the meantime, check for other 16 * versions of this script in the /Net directory, and read the 17 * Notes/ALLfbt_notes.txt for more background on fbt. 18 * 19 * $Id: tcpsnoop_snv.d 69 2007-10-04 13:40:00Z brendan $ 20 * 21 * USAGE: tcpsnoop.d 22 * 23 * FIELDS: 24 * UID user ID 25 * PID process ID 26 * CMD command 27 * LADDR local IP address 28 * RADDR remote IP address 29 * LPORT local port number 30 * RPORT remote port number 31 * DR direction 32 * SIZE packet size, bytes 33 * 34 * SEE ALSO: snoop -rS 35 * 36 * COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. 37 * 38 * CDDL HEADER START 39 * 40 * The contents of this file are subject to the terms of the 41 * Common Development and Distribution License, Version 1.0 only 42 * (the "License"). You may not use this file except in compliance 43 * with the License. 44 * 45 * You can obtain a copy of the license at Docs/cddl1.txt 46 * or http://www.opensolaris.org/os/licensing. 47 * See the License for the specific language governing permissions 48 * and limitations under the License. 49 * 50 * CDDL HEADER END 51 * 52 * Author: Brendan Gregg [Sydney, Australia] 53 * 54 * TODO: IPv6 55 * 56 * 09-Jul-2004 Brendan Gregg Created this. 57 * 12-Mar-2005 " " Changed probes, size info now printed. 58 * 02-Jul-2005 " " Many more probes. Renamed "tcpsnoop.d". 59 * 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct 60 * execname. Thanks Kias Belgaied for expertise. 61 * 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. 62 * 20-Apr-2006 " " Last update. 63 * 30-Sep-2007 " " Bumped this for recent OpenSolaris/Nevada. 64 */ 65 66#pragma D option quiet 67#pragma D option switchrate=10hz 68 69#include <sys/file.h> 70#include <inet/common.h> 71#include <sys/byteorder.h> 72 73/* 74 * Print header 75 */ 76dtrace:::BEGIN 77{ 78 /* print main headers */ 79 printf("%5s %6s %-15s %5s %2s %-15s %5s %5s %s\n", 80 "UID", "PID", "LADDR", "LPORT", "DR", "RADDR", "RPORT", 81 "SIZE", "CMD"); 82} 83 84/* 85 * TCP Process inbound connections 86 * 87 * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was 88 * renamed to SS_DIRECT around build 31. 89 */ 90fbt:sockfs:sotpi_accept:entry 91/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ 92{ 93 self->sop = args[0]; 94} 95 96fbt:sockfs:sotpi_create:return 97/self->sop/ 98{ 99 self->nsop = (struct sonode *)arg1; 100} 101 102fbt:sockfs:sotpi_accept:return 103/self->nsop/ 104{ 105 this->tcpp = (tcp_t *)self->nsop->so_priv; 106 self->connp = (conn_t *)this->tcpp->tcp_connp; 107 tname[(int)self->connp] = execname; 108 tpid[(int)self->connp] = pid; 109 tuid[(int)self->connp] = uid; 110} 111 112fbt:sockfs:sotpi_accept:return 113{ 114 self->nsop = 0; 115 self->sop = 0; 116} 117 118/* 119 * TCP Process outbound connections 120 */ 121fbt:ip:tcp_connect:entry 122{ 123 this->tcpp = (tcp_t *)arg0; 124 self->connp = (conn_t *)this->tcpp->tcp_connp; 125 tname[(int)self->connp] = execname; 126 tpid[(int)self->connp] = pid; 127 tuid[(int)self->connp] = uid; 128} 129 130/* 131 * TCP Data translations 132 */ 133fbt:sockfs:sotpi_accept:return, 134fbt:ip:tcp_connect:return 135/self->connp/ 136{ 137 /* fetch ports */ 138#if defined(_BIG_ENDIAN) 139 self->lport = self->connp->u_port.tcpu_ports.tcpu_lport; 140 self->fport = self->connp->u_port.tcpu_ports.tcpu_fport; 141#else 142 self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport); 143 self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport); 144#endif 145 146 /* fetch IPv4 addresses */ 147 this->fad12 = 148 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; 149 this->fad13 = 150 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; 151 this->fad14 = 152 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; 153 this->fad15 = 154 (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; 155 this->lad12 = 156 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12]; 157 this->lad13 = 158 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13]; 159 this->lad14 = 160 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14]; 161 this->lad15 = 162 (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15]; 163 164 /* convert type for use with lltostr() */ 165 this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12; 166 this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13; 167 this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14; 168 this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15; 169 this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12; 170 this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13; 171 this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14; 172 this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15; 173 174 /* stringify addresses */ 175 self->faddr = strjoin(lltostr(this->fad12), "."); 176 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); 177 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); 178 self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); 179 self->laddr = strjoin(lltostr(this->lad12), "."); 180 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); 181 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); 182 self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); 183 184 /* fix direction and save values */ 185 tladdr[(int)self->connp] = self->laddr; 186 tfaddr[(int)self->connp] = self->faddr; 187 tlport[(int)self->connp] = self->lport; 188 tfport[(int)self->connp] = self->fport; 189 190 /* all systems go */ 191 tok[(int)self->connp] = 1; 192} 193 194/* 195 * TCP Clear connp 196 */ 197fbt:ip:tcp_get_conn:return 198{ 199 /* Q_TO_CONN */ 200 this->connp = (conn_t *)arg1; 201 tok[(int)this->connp] = 0; 202 tpid[(int)this->connp] = 0; 203 tuid[(int)this->connp] = 0; 204 tname[(int)this->connp] = 0; 205} 206 207/* 208 * TCP Process "port closed" 209 */ 210fbt:ip:tcp_xmit_early_reset:entry 211{ 212 this->queuep = args[7]->tcps_g_q; 213 this->connp = (conn_t *)this->queuep->q_ptr; 214 this->tcpp = (tcp_t *)this->connp->conn_tcp; 215 216 /* split addresses */ 217 this->ipha = (ipha_t *)args[1]->b_rptr; 218 this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24; 219 this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16; 220 this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8; 221 this->fad12 = (this->ipha->ipha_src & 0x000000ff); 222 this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24; 223 this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16; 224 this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8; 225 this->lad12 = (this->ipha->ipha_dst & 0x000000ff); 226 227 /* stringify addresses */ 228 self->faddr = strjoin(lltostr(this->fad12), "."); 229 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); 230 self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); 231 self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); 232 self->laddr = strjoin(lltostr(this->lad12), "."); 233 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); 234 self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); 235 self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); 236 237 self->reset = 1; 238} 239 240/* 241 * TCP Fetch "port closed" ports 242 */ 243fbt:ip:tcp_xchg:entry 244/self->reset/ 245{ 246#if defined(_BIG_ENDIAN) 247 self->lport = (uint16_t)arg0; 248 self->fport = (uint16_t)arg1; 249#else 250 self->lport = BSWAP_16((uint16_t)arg0); 251 self->fport = BSWAP_16((uint16_t)arg1); 252#endif 253 self->lport = BE16_TO_U16(arg0); 254 self->fport = BE16_TO_U16(arg1); 255} 256 257/* 258 * TCP Print "port closed" 259 */ 260fbt:ip:tcp_xmit_early_reset:return 261{ 262 self->name = "<closed>"; 263 self->pid = 0; 264 self->uid = 0; 265 self->size = 54; /* should check trailers */ 266 self->dir = "<-"; 267 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 268 self->uid, self->pid, self->laddr, self->lport, self->dir, 269 self->faddr, self->fport, self->size, self->name); 270 self->dir = "->"; 271 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 272 self->uid, self->pid, self->laddr, self->lport, self->dir, 273 self->faddr, self->fport, self->size, self->name); 274 self->reset = 0; 275 self->size = 0; 276 self->name = 0; 277} 278 279/* 280 * TCP Process Write 281 */ 282fbt:ip:tcp_send_data:entry 283{ 284 self->conn_p = (conn_t *)args[0]->tcp_connp; 285} 286 287fbt:ip:tcp_send_data:entry 288/tok[(int)self->conn_p]/ 289{ 290 self->dir = "->"; 291 self->size = msgdsize(args[2]) + 14; /* should check trailers */ 292 self->uid = tuid[(int)self->conn_p]; 293 self->laddr = tladdr[(int)self->conn_p]; 294 self->faddr = tfaddr[(int)self->conn_p]; 295 self->lport = tlport[(int)self->conn_p]; 296 self->fport = tfport[(int)self->conn_p]; 297 self->ok = 2; 298 299 /* follow inetd -> in.* transitions */ 300 self->name = pid && (tname[(int)self->conn_p] == "inetd") ? 301 execname : tname[(int)self->conn_p]; 302 self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? 303 pid : tpid[(int)self->conn_p]; 304 tname[(int)self->conn_p] = self->name; 305 tpid[(int)self->conn_p] = self->pid; 306} 307 308/* 309 * TCP Process Read 310 */ 311fbt:ip:tcp_rput_data:entry 312{ 313 self->conn_p = (conn_t *)arg0; 314 self->size = msgdsize(args[1]) + 14; /* should check trailers */ 315} 316 317fbt:ip:tcp_rput_data:entry 318/tok[(int)self->conn_p]/ 319{ 320 self->dir = "<-"; 321 self->uid = tuid[(int)self->conn_p]; 322 self->laddr = tladdr[(int)self->conn_p]; 323 self->faddr = tfaddr[(int)self->conn_p]; 324 self->lport = tlport[(int)self->conn_p]; 325 self->fport = tfport[(int)self->conn_p]; 326 self->ok = 2; 327 328 /* follow inetd -> in.* transitions */ 329 self->name = pid && (tname[(int)self->conn_p] == "inetd") ? 330 execname : tname[(int)self->conn_p]; 331 self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? 332 pid : tpid[(int)self->conn_p]; 333 tname[(int)self->conn_p] = self->name; 334 tpid[(int)self->conn_p] = self->pid; 335} 336 337/* 338 * TCP Complete printing outbound handshake 339 */ 340fbt:ip:tcp_connect:return 341/self->connp/ 342{ 343 self->name = tname[(int)self->connp]; 344 self->pid = tpid[(int)self->connp]; 345 self->uid = tuid[(int)self->connp]; 346 self->size = 54; /* should check trailers */ 347 self->dir = "->"; 348 /* this packet occured before connp was fully established */ 349 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 350 self->uid, self->pid, self->laddr, self->lport, self->dir, 351 self->faddr, self->fport, self->size, self->name); 352} 353 354/* 355 * TCP Complete printing inbound handshake 356 */ 357fbt:sockfs:sotpi_accept:return 358/self->connp/ 359{ 360 self->name = tname[(int)self->connp]; 361 self->pid = tpid[(int)self->connp]; 362 self->uid = tuid[(int)self->connp]; 363 self->size = 54; /* should check trailers */ 364 /* these packets occured before connp was fully established */ 365 self->dir = "<-"; 366 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 367 self->uid, self->pid, self->laddr, self->lport, self->dir, 368 self->faddr, self->fport, self->size, self->name); 369 self->dir = "->"; 370 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 371 self->uid, self->pid, self->laddr, self->lport, self->dir, 372 self->faddr, self->fport, self->size, self->name); 373 self->dir = "<-"; 374 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 375 self->uid, self->pid, self->laddr, self->lport, self->dir, 376 self->faddr, self->fport, self->size, self->name); 377} 378 379/* 380 * Print output 381 */ 382fbt:ip:tcp_send_data:entry, 383fbt:ip:tcp_rput_data:entry 384/self->ok == 2/ 385{ 386 /* print output line */ 387 printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 388 self->uid, self->pid, self->laddr, self->lport, self->dir, 389 self->faddr, self->fport, self->size, self->name); 390} 391 392/* 393 * TCP Clear connect variables 394 */ 395fbt:sockfs:sotpi_accept:return, 396fbt:ip:tcp_connect:return 397/self->connp/ 398{ 399 self->faddr = 0; 400 self->laddr = 0; 401 self->fport = 0; 402 self->lport = 0; 403 self->connp = 0; 404 self->name = 0; 405 self->pid = 0; 406 self->uid = 0; 407} 408 409/* 410 * TCP Clear r/w variables 411 */ 412fbt:ip:tcp_send_data:entry, 413fbt:ip:tcp_rput_data:entry 414{ 415 self->ok = 0; 416 self->dir = 0; 417 self->uid = 0; 418 self->pid = 0; 419 self->size = 0; 420 self->name = 0; 421 self->lport = 0; 422 self->fport = 0; 423 self->laddr = 0; 424 self->faddr = 0; 425 self->conn_p = 0; 426} 427