1235368Sgnn#!/usr/bin/ksh 2235368Sgnn# 3235368Sgnn# tcpsnoop_snv - snoop TCP network packets by process. 4235368Sgnn# Written using DTrace (Solaris Nevada) 5235368Sgnn# 6235368Sgnn# This analyses TCP network packets and prints the responsible PID and UID, 7235368Sgnn# plus standard details such as IP address and port. This captures traffic 8235368Sgnn# of newly created TCP connections that were established while this program 9235368Sgnn# was running. It can help identify which processes is causing TCP traffic. 10235368Sgnn# 11235368Sgnn# WARNING: This script may only work on Solaris Nevada and OpenSolaris 12235368Sgnn# of the late 2007 vintage, since it uses the fbt provider to trace the raw 13235368Sgnn# operation of a specific version of the kernel. In the future, a 'stable' 14235368Sgnn# network provider should exist which will allow this to be written for that 15235368Sgnn# and subsequent versions of the kernel. In the meantime, check for other 16235368Sgnn# versions of this script in the /Net directory, and read the 17235368Sgnn# Notes/ALLfbt_notes.txt for more background on fbt. 18235368Sgnn# 19235368Sgnn# $Id: tcpsnoop_snv 69 2007-10-04 13:40:00Z brendan $ 20235368Sgnn# 21235368Sgnn# USAGE: tcpsnoop [-a|hjsvZ] [-n name] [-p pid] 22235368Sgnn# 23235368Sgnn# -a # print all data 24235368Sgnn# -j # print project ID 25235368Sgnn# -s # print time, us 26235368Sgnn# -v # print time, string 27235368Sgnn# -Z # print zone ID 28235368Sgnn# -n name # command name to snoop 29235368Sgnn# -p pid # PID to snoop 30235368Sgnn# eg, 31235368Sgnn# tcpsnoop -v # human readable timestamps 32235368Sgnn# tcpsnoop -Z # print zonename 33235368Sgnn# tcpsnoop -n sshd # snoop sshd traffic only 34235368Sgnn# 35235368Sgnn# FIELDS: 36235368Sgnn# UID user ID 37235368Sgnn# PID process ID 38235368Sgnn# CMD command 39235368Sgnn# LADDR local IP address 40235368Sgnn# RADDR remote IP address 41235368Sgnn# LPORT local port number 42235368Sgnn# RPORT remote port number 43235368Sgnn# DR direction 44235368Sgnn# SIZE packet size, bytes 45235368Sgnn# TIME timestamp, us 46235368Sgnn# STRTIME human readable timestamp, string 47235368Sgnn# ZONE zone ID 48235368Sgnn# PROJ project ID 49235368Sgnn# 50235368Sgnn# SEE ALSO: snoop -rS 51235368Sgnn# 52235368Sgnn# COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. 53235368Sgnn# 54235368Sgnn# CDDL HEADER START 55235368Sgnn# 56235368Sgnn# The contents of this file are subject to the terms of the 57235368Sgnn# Common Development and Distribution License, Version 1.0 only 58235368Sgnn# (the "License"). You may not use this file except in compliance 59235368Sgnn# with the License. 60235368Sgnn# 61235368Sgnn# You can obtain a copy of the license at Docs/cddl1.txt 62235368Sgnn# or http://www.opensolaris.org/os/licensing. 63235368Sgnn# See the License for the specific language governing permissions 64235368Sgnn# and limitations under the License. 65235368Sgnn# 66235368Sgnn# CDDL HEADER END 67235368Sgnn# 68235368Sgnn# Author: Brendan Gregg [Sydney, Australia] 69235368Sgnn# 70235368Sgnn# TODO: IPv6 71235368Sgnn# 72235368Sgnn# CODE: 73235368Sgnn# The FILTER syntax matches on packets rather than initial 74235368Sgnn# connections, so that it can follow inetd connections properly. 75235368Sgnn# 76235368Sgnn# 09-Jul-2004 Brendan Gregg Created this. 77235368Sgnn# 12-Mar-2005 " " Changed probes, size info now printed. 78235368Sgnn# 02-Jul-2005 " " Many more probes. Renamed "tcpsnoop.d". 79235368Sgnn# 04-Jul-2005 " " Now wrapped in shell, called "tcpsnoop". 80235368Sgnn# 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct 81235368Sgnn# execname. Thanks Kias Belgaied for expertise. 82235368Sgnn# 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. 83235368Sgnn# 20-Apr-2006 " " Last update. 84235368Sgnn# 30-Sep-2007 " " Bumped this for recent OpenSolaris/Nevada. 85235368Sgnn# 86235368Sgnn 87235368Sgnn############################## 88235368Sgnn# --- Process Arguments --- 89235368Sgnn# 90235368Sgnn 91235368Sgnn### default variables 92235368Sgnnopt_name=0; opt_time=0; opt_timestr=0; filter=0; pname=. 93235368Sgnnopt_zone=0; opt_proj=0; opt_pid=0; pid=0 94235368Sgnn 95235368Sgnn### process options 96235368Sgnnwhile getopts ahjsvZn:p: name 97235368Sgnndo 98235368Sgnn case $name in 99235368Sgnn a) opt_time=1; opt_timestr=1; opt_zone=1; opt_proj=1 ;; 100235368Sgnn n) opt_name=1; pname=$OPTARG ;; 101235368Sgnn p) opt_pid=1; pid=$OPTARG ;; 102235368Sgnn j) opt_proj=1 ;; 103235368Sgnn s) opt_time=1 ;; 104235368Sgnn v) opt_timestr=1 ;; 105235368Sgnn Z) opt_zone=1 ;; 106235368Sgnn h|?) cat <<-END >&2 107235368Sgnn USAGE: tcpsnoop [-a|hjsvZ] [-n name] [-p pid] 108235368Sgnn tcpsnoop # default output 109235368Sgnn -a # print all data 110235368Sgnn -j # print project ID 111235368Sgnn -s # print start time, us 112235368Sgnn -v # print start time, string 113235368Sgnn -Z # print zonename 114235368Sgnn -n name # command name to snoop 115235368Sgnn -p pid # PID to snoop 116235368Sgnn eg, 117235368Sgnn tcpsnoop -v # human readable timestamps 118235368Sgnn tcpsnoop -Z # print zonename 119235368Sgnn tcpsnoop -n sshd # snoop sshd traffic only 120235368Sgnn END 121235368Sgnn exit 1 122235368Sgnn esac 123235368Sgnndone 124235368Sgnn 125235368Sgnn### option logic 126235368Sgnnif (( opt_name || opt_pid )); then 127235368Sgnn filter=1 128235368Sgnnfi 129235368Sgnn 130235368Sgnn################################# 131235368Sgnn# --- Main Program, DTrace --- 132235368Sgnn# 133235368Sgnn/usr/sbin/dtrace -Cs <( print -r ' 134235368Sgnn /* 135235368Sgnn * Command line arguments 136235368Sgnn */ 137235368Sgnn inline int OPT_name = '$opt_name'; 138235368Sgnn inline int OPT_pid = '$opt_pid'; 139235368Sgnn inline int OPT_time = '$opt_time'; 140235368Sgnn inline int OPT_timestr = '$opt_timestr'; 141235368Sgnn inline int OPT_zone = '$opt_zone'; 142235368Sgnn inline int OPT_proj = '$opt_proj'; 143235368Sgnn inline int PID = '$pid'; 144235368Sgnn inline int FILTER = '$filter'; 145235368Sgnn inline string NAME = "'$pname'"; 146235368Sgnn 147235368Sgnn#pragma D option quiet 148235368Sgnn#pragma D option switchrate=10hz 149235368Sgnn 150235368Sgnn#include <sys/file.h> 151235368Sgnn#include <inet/common.h> 152235368Sgnn#include <sys/byteorder.h> 153235368Sgnn#include <sys/socket.h> 154235368Sgnn#include <sys/socketvar.h> 155235368Sgnn 156235368Sgnn/* 157235368Sgnn * Print header 158235368Sgnn */ 159235368Sgnndtrace:::BEGIN 160235368Sgnn{ 161235368Sgnn /* print optional headers */ 162235368Sgnn OPT_time ? printf("%-14s ", "TIME") : 1; 163235368Sgnn OPT_timestr ? printf("%-20s ", "STRTIME") : 1; 164235368Sgnn OPT_zone ? printf("%4s ", "ZONE") : 1; 165235368Sgnn OPT_proj ? printf("%4s ", "PROJ") : 1; 166235368Sgnn 167235368Sgnn /* print main headers */ 168235368Sgnn printf("%5s %6s %-15s %5s %2s %-15s %5s %5s %s\n", 169235368Sgnn "UID", "PID", "LADDR", "LPORT", "DR", "RADDR", "RPORT", 170235368Sgnn "SIZE", "CMD"); 171235368Sgnn} 172235368Sgnn 173235368Sgnn 174235368Sgnn/* 175235368Sgnn * TCP Process inbound connections 176235368Sgnn * 177235368Sgnn * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was 178235368Sgnn * renamed to SS_DIRECT around build 31. 179235368Sgnn */ 180235368Sgnnfbt:sockfs:sotpi_accept:entry 181235368Sgnn/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ 182235368Sgnn{ 183235368Sgnn self->sop = args[0]; 184235368Sgnn} 185235368Sgnn 186235368Sgnnfbt:sockfs:sotpi_create:return 187235368Sgnn/self->sop/ 188235368Sgnn{ 189235368Sgnn self->nsop = (struct sonode *)arg1; 190235368Sgnn} 191235368Sgnn 192235368Sgnnfbt:sockfs:sotpi_accept:return 193235368Sgnn/self->nsop/ 194235368Sgnn{ 195235368Sgnn this->tcpp = (tcp_t *)self->nsop->so_priv; 196235368Sgnn self->connp = (conn_t *)this->tcpp->tcp_connp; 197235368Sgnn tname[(int)self->connp] = execname; 198235368Sgnn tpid[(int)self->connp] = pid; 199235368Sgnn tuid[(int)self->connp] = uid; 200235368Sgnn} 201235368Sgnn 202235368Sgnnfbt:sockfs:sotpi_accept:return 203235368Sgnn{ 204235368Sgnn self->nsop = 0; 205235368Sgnn self->sop = 0; 206235368Sgnn} 207235368Sgnn 208235368Sgnn/* 209235368Sgnn * TCP Process outbound connections 210235368Sgnn */ 211235368Sgnnfbt:ip:tcp_connect:entry 212235368Sgnn{ 213235368Sgnn this->tcpp = (tcp_t *)arg0; 214235368Sgnn self->connp = (conn_t *)this->tcpp->tcp_connp; 215235368Sgnn tname[(int)self->connp] = execname; 216235368Sgnn tpid[(int)self->connp] = pid; 217235368Sgnn tuid[(int)self->connp] = uid; 218235368Sgnn OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1; 219235368Sgnn} 220235368Sgnn 221235368Sgnn/* 222235368Sgnn * TCP Data translations 223235368Sgnn */ 224235368Sgnnfbt:sockfs:sotpi_accept:return, 225235368Sgnnfbt:ip:tcp_connect:return 226235368Sgnn/self->connp/ 227235368Sgnn{ 228235368Sgnn /* fetch ports */ 229235368Sgnn#if defined(_BIG_ENDIAN) 230235368Sgnn self->lport = self->connp->u_port.tcpu_ports.tcpu_lport; 231235368Sgnn self->fport = self->connp->u_port.tcpu_ports.tcpu_fport; 232235368Sgnn#else 233235368Sgnn self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport); 234235368Sgnn self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport); 235235368Sgnn#endif 236235368Sgnn 237235368Sgnn /* fetch IPv4 addresses */ 238235368Sgnn this->fad12 = 239235368Sgnn (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; 240235368Sgnn this->fad13 = 241235368Sgnn (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; 242235368Sgnn this->fad14 = 243235368Sgnn (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; 244235368Sgnn this->fad15 = 245235368Sgnn (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; 246235368Sgnn this->lad12 = 247235368Sgnn (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12]; 248235368Sgnn this->lad13 = 249235368Sgnn (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13]; 250235368Sgnn this->lad14 = 251235368Sgnn (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14]; 252235368Sgnn this->lad15 = 253235368Sgnn (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15]; 254235368Sgnn 255235368Sgnn /* convert type for use with lltostr() */ 256235368Sgnn this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12; 257235368Sgnn this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13; 258235368Sgnn this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14; 259235368Sgnn this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15; 260235368Sgnn this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12; 261235368Sgnn this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13; 262235368Sgnn this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14; 263235368Sgnn this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15; 264235368Sgnn 265235368Sgnn /* stringify addresses */ 266235368Sgnn self->faddr = strjoin(lltostr(this->fad12), "."); 267235368Sgnn self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); 268235368Sgnn self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); 269235368Sgnn self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); 270235368Sgnn self->laddr = strjoin(lltostr(this->lad12), "."); 271235368Sgnn self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); 272235368Sgnn self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); 273235368Sgnn self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); 274235368Sgnn 275235368Sgnn /* fix direction and save values */ 276235368Sgnn tladdr[(int)self->connp] = self->laddr; 277235368Sgnn tfaddr[(int)self->connp] = self->faddr; 278235368Sgnn tlport[(int)self->connp] = self->lport; 279235368Sgnn tfport[(int)self->connp] = self->fport; 280235368Sgnn 281235368Sgnn /* all systems go */ 282235368Sgnn tok[(int)self->connp] = 1; 283235368Sgnn} 284235368Sgnn 285235368Sgnn/* 286235368Sgnn * TCP Clear connp 287235368Sgnn */ 288235368Sgnnfbt:ip:tcp_get_conn:return 289235368Sgnn{ 290235368Sgnn /* Q_TO_CONN */ 291235368Sgnn this->connp = (conn_t *)arg1; 292235368Sgnn tok[(int)this->connp] = 0; 293235368Sgnn tpid[(int)this->connp] = 0; 294235368Sgnn tuid[(int)this->connp] = 0; 295235368Sgnn tname[(int)this->connp] = 0; 296235368Sgnn tproj[(int)this->connp] = 0; 297235368Sgnn} 298235368Sgnn 299235368Sgnn/* 300235368Sgnn * TCP Process "port closed" 301235368Sgnn */ 302235368Sgnnfbt:ip:tcp_xmit_early_reset:entry 303235368Sgnn/FILTER == 0/ 304235368Sgnn{ 305235368Sgnn this->queuep = args[7]->tcps_g_q; 306235368Sgnn this->connp = (conn_t *)this->queuep->q_ptr; 307235368Sgnn this->tcpp = (tcp_t *)this->connp->conn_tcp; 308235368Sgnn self->zoneid = this->connp->conn_zoneid; 309235368Sgnn 310235368Sgnn /* split addresses */ 311235368Sgnn this->ipha = (ipha_t *)args[1]->b_rptr; 312235368Sgnn this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24; 313235368Sgnn this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16; 314235368Sgnn this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8; 315235368Sgnn this->fad12 = (this->ipha->ipha_src & 0x000000ff); 316235368Sgnn this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24; 317235368Sgnn this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16; 318235368Sgnn this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8; 319235368Sgnn this->lad12 = (this->ipha->ipha_dst & 0x000000ff); 320235368Sgnn 321235368Sgnn /* stringify addresses */ 322235368Sgnn self->faddr = strjoin(lltostr(this->fad12), "."); 323235368Sgnn self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); 324235368Sgnn self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); 325235368Sgnn self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); 326235368Sgnn self->laddr = strjoin(lltostr(this->lad12), "."); 327235368Sgnn self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); 328235368Sgnn self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); 329235368Sgnn self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); 330235368Sgnn 331235368Sgnn self->reset = 1; 332235368Sgnn} 333235368Sgnn 334235368Sgnn/* 335235368Sgnn * TCP Fetch "port closed" ports 336235368Sgnn */ 337235368Sgnnfbt:ip:tcp_xchg:entry 338235368Sgnn/self->reset/ 339235368Sgnn{ 340235368Sgnn#if defined(_BIG_ENDIAN) 341235368Sgnn self->lport = (uint16_t)arg0; 342235368Sgnn self->fport = (uint16_t)arg1; 343235368Sgnn#else 344235368Sgnn self->lport = BSWAP_16((uint16_t)arg0); 345235368Sgnn self->fport = BSWAP_16((uint16_t)arg1); 346235368Sgnn#endif 347235368Sgnn self->lport = BE16_TO_U16(arg0); 348235368Sgnn self->fport = BE16_TO_U16(arg1); 349235368Sgnn} 350235368Sgnn 351235368Sgnn/* 352235368Sgnn * TCP Print "port closed" 353235368Sgnn */ 354235368Sgnnfbt:ip:tcp_xmit_early_reset:return 355235368Sgnn/FILTER == 0/ 356235368Sgnn{ 357235368Sgnn self->name = "<closed>"; 358235368Sgnn self->pid = 0; 359235368Sgnn self->uid = 0; 360235368Sgnn self->proj = 0; 361235368Sgnn self->size = 54; /* should check trailers */ 362235368Sgnn self->dir = "<-"; 363235368Sgnn OPT_time ? printf("%-14d ", timestamp/1000) : 1; 364235368Sgnn OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 365235368Sgnn OPT_zone ? printf("%4d ", self->zoneid) : 1; 366235368Sgnn OPT_proj ? printf("%4d ", self->proj) : 1; 367235368Sgnn printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 368235368Sgnn self->uid, self->pid, self->laddr, self->lport, self->dir, 369235368Sgnn self->faddr, self->fport, self->size, self->name); 370235368Sgnn self->dir = "->"; 371235368Sgnn OPT_time ? printf("%-14d ", timestamp/1000) : 1; 372235368Sgnn OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 373235368Sgnn OPT_zone ? printf("%4d ", self->zoneid) : 1; 374235368Sgnn OPT_proj ? printf("%4d ", self->proj) : 1; 375235368Sgnn printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 376235368Sgnn self->uid, self->pid, self->laddr, self->lport, self->dir, 377235368Sgnn self->faddr, self->fport, self->size, self->name); 378235368Sgnn self->reset = 0; 379235368Sgnn self->size = 0; 380235368Sgnn self->name = 0; 381235368Sgnn self->zoneid = 0; 382235368Sgnn} 383235368Sgnn 384235368Sgnn/* 385235368Sgnn * TCP Process Write 386235368Sgnn */ 387235368Sgnnfbt:ip:tcp_send_data:entry 388235368Sgnn{ 389235368Sgnn self->conn_p = (conn_t *)args[0]->tcp_connp; 390235368Sgnn} 391235368Sgnn 392235368Sgnnfbt:ip:tcp_send_data:entry 393235368Sgnn/tok[(int)self->conn_p]/ 394235368Sgnn{ 395235368Sgnn self->dir = "->"; 396235368Sgnn self->size = msgdsize(args[2]) + 14; /* should check trailers */ 397235368Sgnn self->uid = tuid[(int)self->conn_p]; 398235368Sgnn self->laddr = tladdr[(int)self->conn_p]; 399235368Sgnn self->faddr = tfaddr[(int)self->conn_p]; 400235368Sgnn self->lport = tlport[(int)self->conn_p]; 401235368Sgnn self->fport = tfport[(int)self->conn_p]; 402235368Sgnn OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; 403235368Sgnn self->zoneid = self->conn_p->conn_zoneid; 404235368Sgnn self->ok = 2; 405235368Sgnn 406235368Sgnn /* follow inetd -> in.* transitions */ 407235368Sgnn self->name = pid && (tname[(int)self->conn_p] == "inetd") ? 408235368Sgnn execname : tname[(int)self->conn_p]; 409235368Sgnn self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? 410235368Sgnn pid : tpid[(int)self->conn_p]; 411235368Sgnn tname[(int)self->conn_p] = self->name; 412235368Sgnn tpid[(int)self->conn_p] = self->pid; 413235368Sgnn} 414235368Sgnn 415235368Sgnn/* 416235368Sgnn * TCP Process Read 417235368Sgnn */ 418235368Sgnnfbt:ip:tcp_rput_data:entry 419235368Sgnn{ 420235368Sgnn self->conn_p = (conn_t *)arg0; 421235368Sgnn self->size = msgdsize(args[1]) + 14; /* should check trailers */ 422235368Sgnn} 423235368Sgnn 424235368Sgnnfbt:ip:tcp_rput_data:entry 425235368Sgnn/tok[(int)self->conn_p]/ 426235368Sgnn{ 427235368Sgnn self->dir = "<-"; 428235368Sgnn self->uid = tuid[(int)self->conn_p]; 429235368Sgnn self->laddr = tladdr[(int)self->conn_p]; 430235368Sgnn self->faddr = tfaddr[(int)self->conn_p]; 431235368Sgnn self->lport = tlport[(int)self->conn_p]; 432235368Sgnn self->fport = tfport[(int)self->conn_p]; 433235368Sgnn OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; 434235368Sgnn self->zoneid = self->conn_p->conn_zoneid; 435235368Sgnn self->ok = 2; 436235368Sgnn 437235368Sgnn /* follow inetd -> in.* transitions */ 438235368Sgnn self->name = pid && (tname[(int)self->conn_p] == "inetd") ? 439235368Sgnn execname : tname[(int)self->conn_p]; 440235368Sgnn self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? 441235368Sgnn pid : tpid[(int)self->conn_p]; 442235368Sgnn tname[(int)self->conn_p] = self->name; 443235368Sgnn tpid[(int)self->conn_p] = self->pid; 444235368Sgnn} 445235368Sgnn 446235368Sgnn/* 447235368Sgnn * TCP Complete printing outbound handshake 448235368Sgnn */ 449235368Sgnnfbt:ip:tcp_connect:return 450235368Sgnn/self->connp/ 451235368Sgnn{ 452235368Sgnn self->name = tname[(int)self->connp]; 453235368Sgnn self->pid = tpid[(int)self->connp]; 454235368Sgnn self->uid = tuid[(int)self->connp]; 455235368Sgnn self->zoneid = self->connp->conn_zoneid; 456235368Sgnn OPT_proj ? self->proj = tproj[(int)self->connp] : 1; 457235368Sgnn self->size = 54; /* should check trailers */ 458235368Sgnn self->dir = "->"; 459235368Sgnn} 460235368Sgnn 461235368Sgnnfbt:ip:tcp_connect:return 462235368Sgnn/(self->connp) && 463235368Sgnn ((FILTER == 0) || 464235368Sgnn (OPT_pid && self->pid == PID) || 465235368Sgnn (OPT_name && self->name == NAME))/ 466235368Sgnn{ 467235368Sgnn /* this packet occured before connp was fully established */ 468235368Sgnn OPT_time ? printf("%-14d ", timestamp/1000) : 1; 469235368Sgnn OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 470235368Sgnn OPT_zone ? printf("%4d ", self->zoneid) : 1; 471235368Sgnn OPT_proj ? printf("%4d ", self->proj) : 1; 472235368Sgnn printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 473235368Sgnn self->uid, self->pid, self->laddr, self->lport, self->dir, 474235368Sgnn self->faddr, self->fport, self->size, self->name); 475235368Sgnn} 476235368Sgnn 477235368Sgnn/* 478235368Sgnn * TCP Complete printing inbound handshake 479235368Sgnn */ 480235368Sgnnfbt:sockfs:sotpi_accept:return 481235368Sgnn/self->connp/ 482235368Sgnn{ 483235368Sgnn self->name = tname[(int)self->connp]; 484235368Sgnn self->pid = tpid[(int)self->connp]; 485235368Sgnn self->uid = tuid[(int)self->connp]; 486235368Sgnn self->zoneid = self->connp->conn_zoneid; 487235368Sgnn OPT_proj ? self->proj = tproj[(int)self->connp] : 1; 488235368Sgnn self->size = 54; /* should check trailers */ 489235368Sgnn self->dir = "<-"; 490235368Sgnn} 491235368Sgnn 492235368Sgnnfbt:sockfs:sotpi_accept:return 493235368Sgnn/(self->connp) && 494235368Sgnn ((FILTER == 0) || 495235368Sgnn (OPT_pid && self->pid == PID) || 496235368Sgnn (OPT_name && self->name == NAME))/ 497235368Sgnn{ 498235368Sgnn /* these packets occured before connp was fully established */ 499235368Sgnn OPT_time ? printf("%-14d ", timestamp/1000) : 1; 500235368Sgnn OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 501235368Sgnn OPT_zone ? printf("%4d ", self->zoneid) : 1; 502235368Sgnn OPT_proj ? printf("%4d ", self->proj) : 1; 503235368Sgnn printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 504235368Sgnn self->uid, self->pid, self->laddr, self->lport, self->dir, 505235368Sgnn self->faddr, self->fport, self->size, self->name); 506235368Sgnn self->dir = "->"; 507235368Sgnn OPT_time ? printf("%-14d ", timestamp/1000) : 1; 508235368Sgnn OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 509235368Sgnn OPT_zone ? printf("%4d ", self->zoneid) : 1; 510235368Sgnn OPT_proj ? printf("%4d ", self->proj) : 1; 511235368Sgnn printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 512235368Sgnn self->uid, self->pid, self->laddr, self->lport, self->dir, 513235368Sgnn self->faddr, self->fport, self->size, self->name); 514235368Sgnn self->dir = "<-"; 515235368Sgnn OPT_time ? printf("%-14d ", timestamp/1000) : 1; 516235368Sgnn OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 517235368Sgnn OPT_zone ? printf("%4d ", self->zoneid) : 1; 518235368Sgnn OPT_proj ? printf("%4d ", self->proj) : 1; 519235368Sgnn printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 520235368Sgnn self->uid, self->pid, self->laddr, self->lport, self->dir, 521235368Sgnn self->faddr, self->fport, self->size, self->name); 522235368Sgnn} 523235368Sgnn 524235368Sgnn/* 525235368Sgnn * Print output 526235368Sgnn */ 527235368Sgnnfbt:ip:tcp_send_data:entry, 528235368Sgnnfbt:ip:tcp_rput_data:entry 529235368Sgnn/(self->ok == 2) && 530235368Sgnn ((FILTER == 0) || 531235368Sgnn (OPT_pid && self->pid == PID) || 532235368Sgnn (OPT_name && self->name == NAME))/ 533235368Sgnn{ 534235368Sgnn /* print optional fields */ 535235368Sgnn OPT_time ? printf("%-14d ", timestamp/1000) : 1; 536235368Sgnn OPT_timestr ? printf("%-20Y ", walltimestamp) : 1; 537235368Sgnn OPT_zone ? printf("%4d ", self->zoneid) : 1; 538235368Sgnn OPT_proj ? printf("%4d ", self->proj) : 1; 539235368Sgnn 540235368Sgnn /* print output line */ 541235368Sgnn printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n", 542235368Sgnn self->uid, self->pid, self->laddr, self->lport, self->dir, 543235368Sgnn self->faddr, self->fport, self->size, self->name); 544235368Sgnn} 545235368Sgnn 546235368Sgnn/* 547235368Sgnn * TCP Clear connect variables 548235368Sgnn */ 549235368Sgnnfbt:sockfs:sotpi_accept:return, 550235368Sgnnfbt:ip:tcp_connect:return 551235368Sgnn/self->connp/ 552235368Sgnn{ 553235368Sgnn self->faddr = 0; 554235368Sgnn self->laddr = 0; 555235368Sgnn self->fport = 0; 556235368Sgnn self->lport = 0; 557235368Sgnn self->connp = 0; 558235368Sgnn self->name = 0; 559235368Sgnn self->pid = 0; 560235368Sgnn self->uid = 0; 561235368Sgnn} 562235368Sgnn 563235368Sgnn/* 564235368Sgnn * TCP Clear r/w variables 565235368Sgnn */ 566235368Sgnnfbt:ip:tcp_send_data:entry, 567235368Sgnnfbt:ip:tcp_rput_data:entry 568235368Sgnn{ 569235368Sgnn self->ok = 0; 570235368Sgnn self->dir = 0; 571235368Sgnn self->uid = 0; 572235368Sgnn self->pid = 0; 573235368Sgnn self->size = 0; 574235368Sgnn self->name = 0; 575235368Sgnn self->lport = 0; 576235368Sgnn self->fport = 0; 577235368Sgnn self->laddr = 0; 578235368Sgnn self->faddr = 0; 579235368Sgnn self->conn_p = 0; 580235368Sgnn self->zoneid = 0; 581235368Sgnn self->proj = 0; 582235368Sgnn} 583235368Sgnn') 584