1#!/usr/bin/ksh
2#
3# tcptop - display top TCP network packets by process. 
4#          Written using DTrace (Solaris 10 3/05)
5#
6# This analyses TCP network packets and prints the responsible PID and UID,
7# plus standard details such as IP address and port. This captures traffic
8# of newly created TCP connections that were established while this program
9# was running. It can help identify which processes is causing TCP traffic.
10#
11# WARNING: This script may only work on Solaris 10 3/05, since it uses the
12# fbt provider to trace the raw operation of a specific version of the kernel.
13# In the future, a 'stable' network provider should exist which will allow
14# this to be written for that and subsequent versions of the kernel. In the
15# meantime, check for other versions of this script in the /Net directory,
16# and read the Notes/ALLfbt_notes.txt for more background on fbt.
17#
18# $Id: tcptop 69 2007-10-04 13:40:00Z brendan $
19#
20# USAGE:	tcptop [-Ch] [-j|-Z] [interval [count]]
21#
22#		-C		# don't clear the screen
23#		-j		# print project IDs
24#		-Z		# print zone IDs
25#
26# FIELDS:
27#		UID     	user ID
28#		PID     	process ID
29#		CMD     	command
30#		LADDR		local IP address
31#		RADDR		remote IP address
32#		LPORT		local port number
33#		RPORT		remote port number
34#		SIZE    	packet size, bytes
35#		load		1 min load average
36#		TCPin		TCP inbound payload data
37#		TCPout		TCP outbound payload data
38#		ZONE    	zone ID
39#		PROJ    	project ID
40#
41# SEE ALSO:	tcpsnoop
42#
43# COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg.
44#
45# CDDL HEADER START
46#
47#  The contents of this file are subject to the terms of the
48#  Common Development and Distribution License, Version 1.0 only
49#  (the "License").  You may not use this file except in compliance
50#  with the License.
51#
52#  You can obtain a copy of the license at Docs/cddl1.txt
53#  or http://www.opensolaris.org/os/licensing.
54#  See the License for the specific language governing permissions
55#  and limitations under the License.
56#
57# CDDL HEADER END
58#
59# Author: Brendan Gregg  [Sydney, Australia]
60#
61# ToDo: IPv6
62#
63# 05-Jul-2005  Brendan Gregg	Created this.
64# 03-Dec-2005	  "	 "	Fixed tcp_accept_finish bug, now 100% correct
65#				execname. Thanks Kias Belgaied for expertise.
66# 20-Apr-2006     "      "      Fixed SS_TCP_FAST_ACCEPT bug in build 31+.
67# 20-Apr-2006     "      "      Last update.
68#
69
70##############################
71# --- Process Arguments ---
72#
73
74### default variables
75opt_def=1; opt_clear=1; opt_zone=0; opt_proj=0; interval=5; count=-1
76
77### process options
78while getopts ChjZ name
79do
80	case $name in
81	C)      opt_clear=0 ;;
82	j)      opt_proj=1; opt_def=0 ;;
83	Z)      opt_zone=1; opt_def=0 ;;
84	h|?)    cat <<-END >&2
85		USAGE: tcptop [-h] [-j|-Z] [interval [count]]
86		       tcptop                  # default output
87		                -C             # don't clear the screen
88		                -j             # print project ID
89		                -Z             # print zonename
90		  eg,
91		      tcptop                   # default is 5 sec interval
92		      tcptop 2                 # 2 second interval
93		      tcptop -C 1 10           # 10 x 1 sec samples, no clear
94		END
95		exit 1
96	esac
97done
98shift $(( $OPTIND - 1 ))
99
100### option logic
101if [[ "$1" > 0 ]]; then
102        interval=$1; shift
103fi
104if [[ "$1" > 0 ]]; then
105        count=$1; shift
106fi
107if (( opt_proj && opt_zone )); then
108	opt_proj=0
109fi
110if (( opt_clear )); then
111	clearstr=`clear`
112else
113	clearstr=.
114fi
115
116#################################
117# --- Main Program, DTrace ---
118#
119/usr/sbin/dtrace -Cs <( print -r '
120 /*
121  * Command line arguments
122  */
123 inline int OPT_def   = '$opt_def';
124 inline int OPT_zone  = '$opt_zone';
125 inline int OPT_proj  = '$opt_proj';
126 inline int OPT_clear = '$opt_clear';
127 inline int INTERVAL  = '$interval';
128 inline int COUNTER   = '$count';
129 inline string CLEAR  = "'$clearstr'";
130
131#pragma D option quiet
132#pragma D option switchrate=10hz
133
134#include <sys/file.h>
135#include <inet/common.h>
136#include <sys/byteorder.h>
137#include <sys/socket.h>
138#include <sys/socketvar.h>
139
140/*
141 * Print header
142 */
143dtrace:::BEGIN
144{
145	/* starting values */
146        counts = COUNTER;
147        secs = INTERVAL;
148	TCP_out = 0;
149	TCP_in = 0;
150
151	printf("Tracing... Please wait.\n");
152}
153
154/*
155 * TCP Process inbound connections
156 *
157 * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was
158 * renamed to SS_DIRECT around build 31.
159 */
160fbt:sockfs:sotpi_accept:entry
161/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/
162{
163	self->sop = args[0];
164}
165
166fbt:sockfs:sotpi_create:return
167/self->sop/
168{
169	self->nsop = (struct sonode *)arg1;
170}
171
172fbt:sockfs:sotpi_accept:return
173/self->nsop/
174{
175	this->tcpp = (tcp_t *)self->nsop->so_priv;
176	self->connp = (conn_t *)this->tcpp->tcp_connp;
177	tname[(int)self->connp] = execname;
178	tpid[(int)self->connp] = pid;
179	tuid[(int)self->connp] = uid;
180}
181
182fbt:sockfs:sotpi_accept:return
183{
184	self->nsop = 0;
185	self->sop = 0;
186}
187
188/*
189 * TCP Process outbound connections
190 */
191fbt:ip:tcp_connect:entry
192{
193	this->tcpp = (tcp_t *)arg0;
194	self->connp = (conn_t *)this->tcpp->tcp_connp;
195	tname[(int)self->connp] = execname;
196	tpid[(int)self->connp] = pid;
197	tuid[(int)self->connp] = uid;
198	OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1;
199}
200
201/*
202 * TCP Data translations
203 */
204fbt:sockfs:sotpi_accept:return,
205fbt:ip:tcp_connect:return
206/self->connp/
207{
208	/* fetch ports */
209#if defined(_BIG_ENDIAN)
210	self->lport = self->connp->u_port.tcpu_ports.tcpu_lport;
211	self->fport = self->connp->u_port.tcpu_ports.tcpu_fport;
212#else
213	self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport);
214	self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport);
215#endif
216
217	/* fetch IPv4 addresses */
218	this->fad12 =
219	    (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12];
220	this->fad13 =
221	    (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13];
222	this->fad14 =
223	    (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14];
224	this->fad15 =
225	    (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15];
226	this->lad12 =
227	    (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12];
228	this->lad13 =
229	    (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13];
230	this->lad14 =
231	    (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14];
232	this->lad15 =
233	    (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15];
234
235	/* convert type for use with lltostr() */
236	this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12;
237	this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13;
238	this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14;
239	this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15;
240	this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12;
241	this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13;
242	this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14;
243	this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15;
244
245	/* stringify addresses */
246	self->faddr = strjoin(lltostr(this->fad12), ".");
247	self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
248	self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
249	self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
250	self->laddr = strjoin(lltostr(this->lad12), ".");
251	self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
252	self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
253	self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
254
255	/* fix direction and save values */
256	tladdr[(int)self->connp] = self->laddr;
257	tfaddr[(int)self->connp] = self->faddr;
258	tlport[(int)self->connp] = self->lport;
259	tfport[(int)self->connp] = self->fport;
260
261	/* all systems go */
262	tok[(int)self->connp] = 1;
263}
264
265/*
266 * TCP Clear connp
267 */
268fbt:ip:tcp_get_conn:return
269{
270	/* Q_TO_CONN */
271	this->connp = (conn_t *)arg1;
272	tok[(int)this->connp] = 0;
273	tpid[(int)this->connp] = 0;
274	tuid[(int)this->connp] = 0;
275	tname[(int)this->connp] = 0;
276	tproj[(int)this->connp] = 0;
277}
278
279/*
280 * TCP Process "port closed"
281 */
282fbt:ip:tcp_xmit_early_reset:entry
283{
284	this->queuep = (queue_t *)`tcp_g_q; /* ` */
285	this->connp = (conn_t *)this->queuep->q_ptr;
286	this->tcpp = (tcp_t *)this->connp->conn_tcp;
287	self->zoneid = this->connp->conn_zoneid;
288
289	/* split addresses */
290	this->ipha = (ipha_t *)args[1]->b_rptr;
291	this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24;
292	this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16;
293	this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8;
294	this->fad12 = (this->ipha->ipha_src & 0x000000ff);
295	this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24;
296	this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16;
297	this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8;
298	this->lad12 = (this->ipha->ipha_dst & 0x000000ff);
299
300	/* stringify addresses */
301	self->faddr = strjoin(lltostr(this->fad12), ".");
302	self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
303	self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
304	self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
305	self->laddr = strjoin(lltostr(this->lad12), ".");
306	self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
307	self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
308	self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
309
310	self->reset = 1;
311}
312
313/*
314 * TCP Fetch "port closed" ports
315 */
316fbt:ip:tcp_xchg:entry
317/self->reset/
318{
319#if defined(_BIG_ENDIAN)
320	self->lport = (uint16_t)arg0;
321	self->fport = (uint16_t)arg1;
322#else
323	self->lport = BSWAP_16((uint16_t)arg0);
324	self->fport = BSWAP_16((uint16_t)arg1);
325#endif
326	self->lport = BE16_TO_U16(arg0);
327	self->fport = BE16_TO_U16(arg1);
328}
329
330/*
331 * TCP Print "port closed"
332 */
333fbt:ip:tcp_xmit_early_reset:return
334{
335	self->name = "<closed>";
336	self->pid = 0;
337	self->uid = 0;
338	self->proj = 0;
339	self->size = 54 * 2;	/* should check trailers */
340	OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport,
341	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
342	OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport,
343	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
344	OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport,
345	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
346	self->reset = 0;
347	self->size = 0;
348	self->name = 0;
349}
350
351/*
352 * TCP Process Write
353 */
354fbt:ip:tcp_send_data:entry
355{
356	self->conn_p = (conn_t *)args[0]->tcp_connp;
357}
358
359fbt:ip:tcp_send_data:entry
360/tok[(int)self->conn_p]/
361{
362        self->size = msgdsize(args[2]) + 14;	/* should check trailers */
363	self->uid = tuid[(int)self->conn_p];
364	self->laddr = tladdr[(int)self->conn_p];
365	self->faddr = tfaddr[(int)self->conn_p];
366	self->lport = tlport[(int)self->conn_p];
367	self->fport = tfport[(int)self->conn_p];
368	OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1;
369	self->zoneid = self->conn_p->conn_zoneid;
370        self->ok = 2;
371
372	/* follow inetd -> in.* transitions */
373	self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
374	    execname : tname[(int)self->conn_p];
375	self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
376	    pid : tpid[(int)self->conn_p];
377	tname[(int)self->conn_p] = self->name;
378	tpid[(int)self->conn_p] = self->pid;
379}
380
381/*
382 * TCP Process Read
383 */
384fbt:ip:tcp_rput_data:entry
385{
386	self->conn_p = (conn_t *)arg0;
387        self->size = msgdsize(args[1]) + 14;	/* should check trailers */
388}
389
390fbt:ip:tcp_rput_data:entry
391/tok[(int)self->conn_p]/
392{
393	self->uid = tuid[(int)self->conn_p];
394	self->laddr = tladdr[(int)self->conn_p];
395	self->faddr = tfaddr[(int)self->conn_p];
396	self->lport = tlport[(int)self->conn_p];
397	self->fport = tfport[(int)self->conn_p];
398	OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1;
399	self->zoneid = self->conn_p->conn_zoneid;
400	self->ok = 2;
401
402	/* follow inetd -> in.* transitions */
403	self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
404	    execname : tname[(int)self->conn_p];
405	self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
406	    pid : tpid[(int)self->conn_p];
407	tname[(int)self->conn_p] = self->name;
408	tpid[(int)self->conn_p] = self->pid;
409}
410
411/*
412 * TCP Complete printing outbound handshake
413 */
414fbt:ip:tcp_connect:return
415/self->connp/
416{
417	self->name = tname[(int)self->connp];
418	self->pid = tpid[(int)self->connp];
419	self->uid = tuid[(int)self->connp];
420	self->zoneid = self->connp->conn_zoneid;
421	OPT_proj ? self->proj = tproj[(int)self->connp] : 1;
422	self->size = 54;	/* should check trailers */
423
424	/* this packet occured before connp was fully established */
425	OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport,
426	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
427	OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport,
428	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
429	OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport,
430	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
431}
432
433/*
434 * TCP Complete printing inbound handshake
435 */
436fbt:sockfs:sotpi_accept:return
437/self->connp/
438{
439	self->name = tname[(int)self->connp];
440	self->pid = tpid[(int)self->connp];
441	self->uid = tuid[(int)self->connp];
442	self->zoneid = self->connp->conn_zoneid;
443	OPT_proj ? self->proj = tproj[(int)self->connp] : 1;
444	self->size = 54 * 3;	/* should check trailers */
445
446	/* these packets occured before connp was fully established */
447	OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport,
448	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
449	OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport,
450	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
451	OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport,
452	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
453}
454
455/*
456 * TCP Save data
457 */
458fbt:ip:tcp_send_data:entry,
459fbt:ip:tcp_rput_data:entry
460/self->ok == 2/ 
461{
462	/* save r+w data*/
463	OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport,
464	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
465	OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport,
466	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
467	OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport,
468	    self->faddr, self->fport, self->name] = sum(self->size) : 1;
469}
470
471/* 
472 * TCP Clear connect variables
473 */
474fbt:sockfs:sotpi_accept:return,
475fbt:ip:tcp_connect:return
476/self->connp/
477{
478	self->faddr = 0;
479	self->laddr = 0;
480	self->fport = 0;
481	self->lport = 0;
482	self->connp = 0;
483	self->name = 0;
484	self->pid = 0;
485	self->uid = 0;
486}
487
488/* 
489 * TCP Clear r/w variables
490 */
491fbt:ip:tcp_send_data:entry,
492fbt:ip:tcp_rput_data:entry
493{
494	self->ok = 0;
495	self->uid = 0;
496	self->pid = 0;
497	self->size = 0;
498	self->name = 0;
499	self->lport = 0;
500	self->fport = 0;
501	self->laddr = 0;
502	self->faddr = 0;
503	self->conn_p = 0;
504	self->zoneid = 0;
505	self->proj = 0;
506}
507
508/*
509 * TCP Systemwide Stats
510 */
511mib:::tcpOutDataBytes       { TCP_out += args[0]; }
512mib:::tcpRetransBytes       { TCP_out += args[0]; }
513mib:::tcpInDataInorderBytes { TCP_in  += args[0]; }
514mib:::tcpInDataDupBytes     { TCP_in  += args[0]; }
515mib:::tcpInDataUnorderBytes { TCP_in  += args[0]; }
516
517/*
518 * Timer
519 */
520profile:::tick-1sec
521{
522        secs--;
523}
524
525/*
526 * Print Report
527 */
528profile:::tick-1sec
529/secs == 0/
530{
531        /* fetch 1 min load average */
532        this->load1a  = `hp_avenrun[0] / 65536;
533        this->load1b  = ((`hp_avenrun[0] % 65536) * 100) / 65536;
534
535	/* convert TCP counters to Kbytes */
536	TCP_out /= 1024;
537	TCP_in  /= 1024;
538
539	/* print status */
540	OPT_clear ? printf("%s", CLEAR) : 1;
541        printf("%Y,  load: %d.%02d,  TCPin: %6d KB,  TCPout: %6d KB\n\n",
542            walltimestamp, this->load1a, this->load1b, TCP_in, TCP_out);
543
544	/* print headers */
545	OPT_def  ? printf(" UID ") : 1;
546	OPT_proj ? printf("PROJ ") : 1;
547	OPT_zone ? printf("ZONE ") : 1;
548        printf("%6s %-15s %5s %-15s %5s %9s %s\n",
549	    "PID", "LADDR", "LPORT", "RADDR", "RPORT", "SIZE", "NAME");
550
551	/* print data */
552        printa("%4d %6d %-15s %5d %-15s %5d %@9d %s\n", @out);
553	printf("\n");
554
555	/* clear data */
556        trunc(@out);
557	TCP_in = 0;
558	TCP_out = 0;
559        secs = INTERVAL;
560        counts--;
561}
562
563/*
564 * End of program
565 */
566profile:::tick-1sec
567/counts == 0/
568{
569        exit(0);
570}
571
572/*
573 * Cleanup for Ctrl-C
574 */
575dtrace:::END
576{
577        trunc(@out);
578}
579')
580