1235368Sgnn#!/usr/bin/ksh 2235368Sgnn# 3235368Sgnn# tcptop - display top TCP network packets by process. 4235368Sgnn# Written using DTrace (Solaris 10 3/05) 5235368Sgnn# 6235368Sgnn# This analyses TCP network packets and prints the responsible PID and UID, 7235368Sgnn# plus standard details such as IP address and port. This captures traffic 8235368Sgnn# of newly created TCP connections that were established while this program 9235368Sgnn# was running. It can help identify which processes is causing TCP traffic. 10235368Sgnn# 11235368Sgnn# WARNING: This script may only work on Solaris 10 3/05, since it uses the 12235368Sgnn# fbt provider to trace the raw operation of a specific version of the kernel. 13235368Sgnn# In the future, a 'stable' network provider should exist which will allow 14235368Sgnn# this to be written for that and subsequent versions of the kernel. In the 15235368Sgnn# meantime, check for other versions of this script in the /Net directory, 16235368Sgnn# and read the Notes/ALLfbt_notes.txt for more background on fbt. 17235368Sgnn# 18235368Sgnn# $Id: tcptop 69 2007-10-04 13:40:00Z brendan $ 19235368Sgnn# 20235368Sgnn# USAGE: tcptop [-Ch] [-j|-Z] [interval [count]] 21235368Sgnn# 22235368Sgnn# -C # don't clear the screen 23235368Sgnn# -j # print project IDs 24235368Sgnn# -Z # print zone IDs 25235368Sgnn# 26235368Sgnn# FIELDS: 27235368Sgnn# UID user ID 28235368Sgnn# PID process ID 29235368Sgnn# CMD command 30235368Sgnn# LADDR local IP address 31235368Sgnn# RADDR remote IP address 32235368Sgnn# LPORT local port number 33235368Sgnn# RPORT remote port number 34235368Sgnn# SIZE packet size, bytes 35235368Sgnn# load 1 min load average 36235368Sgnn# TCPin TCP inbound payload data 37235368Sgnn# TCPout TCP outbound payload data 38235368Sgnn# ZONE zone ID 39235368Sgnn# PROJ project ID 40235368Sgnn# 41235368Sgnn# SEE ALSO: tcpsnoop 42235368Sgnn# 43235368Sgnn# COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. 44235368Sgnn# 45235368Sgnn# CDDL HEADER START 46235368Sgnn# 47235368Sgnn# The contents of this file are subject to the terms of the 48235368Sgnn# Common Development and Distribution License, Version 1.0 only 49235368Sgnn# (the "License"). You may not use this file except in compliance 50235368Sgnn# with the License. 51235368Sgnn# 52235368Sgnn# You can obtain a copy of the license at Docs/cddl1.txt 53235368Sgnn# or http://www.opensolaris.org/os/licensing. 54235368Sgnn# See the License for the specific language governing permissions 55235368Sgnn# and limitations under the License. 56235368Sgnn# 57235368Sgnn# CDDL HEADER END 58235368Sgnn# 59235368Sgnn# Author: Brendan Gregg [Sydney, Australia] 60235368Sgnn# 61235368Sgnn# ToDo: IPv6 62235368Sgnn# 63235368Sgnn# 05-Jul-2005 Brendan Gregg Created this. 64235368Sgnn# 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct 65235368Sgnn# execname. Thanks Kias Belgaied for expertise. 66235368Sgnn# 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. 67235368Sgnn# 20-Apr-2006 " " Last update. 68235368Sgnn# 69235368Sgnn 70235368Sgnn############################## 71235368Sgnn# --- Process Arguments --- 72235368Sgnn# 73235368Sgnn 74235368Sgnn### default variables 75235368Sgnnopt_def=1; opt_clear=1; opt_zone=0; opt_proj=0; interval=5; count=-1 76235368Sgnn 77235368Sgnn### process options 78235368Sgnnwhile getopts ChjZ name 79235368Sgnndo 80235368Sgnn case $name in 81235368Sgnn C) opt_clear=0 ;; 82235368Sgnn j) opt_proj=1; opt_def=0 ;; 83235368Sgnn Z) opt_zone=1; opt_def=0 ;; 84235368Sgnn h|?) cat <<-END >&2 85235368Sgnn USAGE: tcptop [-h] [-j|-Z] [interval [count]] 86235368Sgnn tcptop # default output 87235368Sgnn -C # don't clear the screen 88235368Sgnn -j # print project ID 89235368Sgnn -Z # print zonename 90235368Sgnn eg, 91235368Sgnn tcptop # default is 5 sec interval 92235368Sgnn tcptop 2 # 2 second interval 93235368Sgnn tcptop -C 1 10 # 10 x 1 sec samples, no clear 94235368Sgnn END 95235368Sgnn exit 1 96235368Sgnn esac 97235368Sgnndone 98235368Sgnnshift $(( $OPTIND - 1 )) 99235368Sgnn 100235368Sgnn### option logic 101235368Sgnnif [[ "$1" > 0 ]]; then 102235368Sgnn interval=$1; shift 103235368Sgnnfi 104235368Sgnnif [[ "$1" > 0 ]]; then 105235368Sgnn count=$1; shift 106235368Sgnnfi 107235368Sgnnif (( opt_proj && opt_zone )); then 108235368Sgnn opt_proj=0 109235368Sgnnfi 110235368Sgnnif (( opt_clear )); then 111235368Sgnn clearstr=`clear` 112235368Sgnnelse 113235368Sgnn clearstr=. 114235368Sgnnfi 115235368Sgnn 116235368Sgnn################################# 117235368Sgnn# --- Main Program, DTrace --- 118235368Sgnn# 119235368Sgnn/usr/sbin/dtrace -Cs <( print -r ' 120235368Sgnn /* 121235368Sgnn * Command line arguments 122235368Sgnn */ 123235368Sgnn inline int OPT_def = '$opt_def'; 124235368Sgnn inline int OPT_zone = '$opt_zone'; 125235368Sgnn inline int OPT_proj = '$opt_proj'; 126235368Sgnn inline int OPT_clear = '$opt_clear'; 127235368Sgnn inline int INTERVAL = '$interval'; 128235368Sgnn inline int COUNTER = '$count'; 129235368Sgnn inline string CLEAR = "'$clearstr'"; 130235368Sgnn 131235368Sgnn#pragma D option quiet 132235368Sgnn#pragma D option switchrate=10hz 133235368Sgnn 134235368Sgnn#include <sys/file.h> 135235368Sgnn#include <inet/common.h> 136235368Sgnn#include <sys/byteorder.h> 137235368Sgnn#include <sys/socket.h> 138235368Sgnn#include <sys/socketvar.h> 139235368Sgnn 140235368Sgnn/* 141235368Sgnn * Print header 142235368Sgnn */ 143235368Sgnndtrace:::BEGIN 144235368Sgnn{ 145235368Sgnn /* starting values */ 146235368Sgnn counts = COUNTER; 147235368Sgnn secs = INTERVAL; 148235368Sgnn TCP_out = 0; 149235368Sgnn TCP_in = 0; 150235368Sgnn 151235368Sgnn printf("Tracing... Please wait.\n"); 152235368Sgnn} 153235368Sgnn 154235368Sgnn/* 155235368Sgnn * TCP Process inbound connections 156235368Sgnn * 157235368Sgnn * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was 158235368Sgnn * renamed to SS_DIRECT around build 31. 159235368Sgnn */ 160235368Sgnnfbt:sockfs:sotpi_accept:entry 161235368Sgnn/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ 162235368Sgnn{ 163235368Sgnn self->sop = args[0]; 164235368Sgnn} 165235368Sgnn 166235368Sgnnfbt:sockfs:sotpi_create:return 167235368Sgnn/self->sop/ 168235368Sgnn{ 169235368Sgnn self->nsop = (struct sonode *)arg1; 170235368Sgnn} 171235368Sgnn 172235368Sgnnfbt:sockfs:sotpi_accept:return 173235368Sgnn/self->nsop/ 174235368Sgnn{ 175235368Sgnn this->tcpp = (tcp_t *)self->nsop->so_priv; 176235368Sgnn self->connp = (conn_t *)this->tcpp->tcp_connp; 177235368Sgnn tname[(int)self->connp] = execname; 178235368Sgnn tpid[(int)self->connp] = pid; 179235368Sgnn tuid[(int)self->connp] = uid; 180235368Sgnn} 181235368Sgnn 182235368Sgnnfbt:sockfs:sotpi_accept:return 183235368Sgnn{ 184235368Sgnn self->nsop = 0; 185235368Sgnn self->sop = 0; 186235368Sgnn} 187235368Sgnn 188235368Sgnn/* 189235368Sgnn * TCP Process outbound connections 190235368Sgnn */ 191235368Sgnnfbt:ip:tcp_connect:entry 192235368Sgnn{ 193235368Sgnn this->tcpp = (tcp_t *)arg0; 194235368Sgnn self->connp = (conn_t *)this->tcpp->tcp_connp; 195235368Sgnn tname[(int)self->connp] = execname; 196235368Sgnn tpid[(int)self->connp] = pid; 197235368Sgnn tuid[(int)self->connp] = uid; 198235368Sgnn OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1; 199235368Sgnn} 200235368Sgnn 201235368Sgnn/* 202235368Sgnn * TCP Data translations 203235368Sgnn */ 204235368Sgnnfbt:sockfs:sotpi_accept:return, 205235368Sgnnfbt:ip:tcp_connect:return 206235368Sgnn/self->connp/ 207235368Sgnn{ 208235368Sgnn /* fetch ports */ 209235368Sgnn#if defined(_BIG_ENDIAN) 210235368Sgnn self->lport = self->connp->u_port.tcpu_ports.tcpu_lport; 211235368Sgnn self->fport = self->connp->u_port.tcpu_ports.tcpu_fport; 212235368Sgnn#else 213235368Sgnn self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport); 214235368Sgnn self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport); 215235368Sgnn#endif 216235368Sgnn 217235368Sgnn /* fetch IPv4 addresses */ 218235368Sgnn this->fad12 = 219235368Sgnn (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; 220235368Sgnn this->fad13 = 221235368Sgnn (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; 222235368Sgnn this->fad14 = 223235368Sgnn (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; 224235368Sgnn this->fad15 = 225235368Sgnn (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; 226235368Sgnn this->lad12 = 227235368Sgnn (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12]; 228235368Sgnn this->lad13 = 229235368Sgnn (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13]; 230235368Sgnn this->lad14 = 231235368Sgnn (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14]; 232235368Sgnn this->lad15 = 233235368Sgnn (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15]; 234235368Sgnn 235235368Sgnn /* convert type for use with lltostr() */ 236235368Sgnn this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12; 237235368Sgnn this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13; 238235368Sgnn this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14; 239235368Sgnn this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15; 240235368Sgnn this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12; 241235368Sgnn this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13; 242235368Sgnn this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14; 243235368Sgnn this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15; 244235368Sgnn 245235368Sgnn /* stringify addresses */ 246235368Sgnn self->faddr = strjoin(lltostr(this->fad12), "."); 247235368Sgnn self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); 248235368Sgnn self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); 249235368Sgnn self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); 250235368Sgnn self->laddr = strjoin(lltostr(this->lad12), "."); 251235368Sgnn self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); 252235368Sgnn self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); 253235368Sgnn self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); 254235368Sgnn 255235368Sgnn /* fix direction and save values */ 256235368Sgnn tladdr[(int)self->connp] = self->laddr; 257235368Sgnn tfaddr[(int)self->connp] = self->faddr; 258235368Sgnn tlport[(int)self->connp] = self->lport; 259235368Sgnn tfport[(int)self->connp] = self->fport; 260235368Sgnn 261235368Sgnn /* all systems go */ 262235368Sgnn tok[(int)self->connp] = 1; 263235368Sgnn} 264235368Sgnn 265235368Sgnn/* 266235368Sgnn * TCP Clear connp 267235368Sgnn */ 268235368Sgnnfbt:ip:tcp_get_conn:return 269235368Sgnn{ 270235368Sgnn /* Q_TO_CONN */ 271235368Sgnn this->connp = (conn_t *)arg1; 272235368Sgnn tok[(int)this->connp] = 0; 273235368Sgnn tpid[(int)this->connp] = 0; 274235368Sgnn tuid[(int)this->connp] = 0; 275235368Sgnn tname[(int)this->connp] = 0; 276235368Sgnn tproj[(int)this->connp] = 0; 277235368Sgnn} 278235368Sgnn 279235368Sgnn/* 280235368Sgnn * TCP Process "port closed" 281235368Sgnn */ 282235368Sgnnfbt:ip:tcp_xmit_early_reset:entry 283235368Sgnn{ 284235368Sgnn this->queuep = (queue_t *)`tcp_g_q; /* ` */ 285235368Sgnn this->connp = (conn_t *)this->queuep->q_ptr; 286235368Sgnn this->tcpp = (tcp_t *)this->connp->conn_tcp; 287235368Sgnn self->zoneid = this->connp->conn_zoneid; 288235368Sgnn 289235368Sgnn /* split addresses */ 290235368Sgnn this->ipha = (ipha_t *)args[1]->b_rptr; 291235368Sgnn this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24; 292235368Sgnn this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16; 293235368Sgnn this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8; 294235368Sgnn this->fad12 = (this->ipha->ipha_src & 0x000000ff); 295235368Sgnn this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24; 296235368Sgnn this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16; 297235368Sgnn this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8; 298235368Sgnn this->lad12 = (this->ipha->ipha_dst & 0x000000ff); 299235368Sgnn 300235368Sgnn /* stringify addresses */ 301235368Sgnn self->faddr = strjoin(lltostr(this->fad12), "."); 302235368Sgnn self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); 303235368Sgnn self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); 304235368Sgnn self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); 305235368Sgnn self->laddr = strjoin(lltostr(this->lad12), "."); 306235368Sgnn self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); 307235368Sgnn self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); 308235368Sgnn self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); 309235368Sgnn 310235368Sgnn self->reset = 1; 311235368Sgnn} 312235368Sgnn 313235368Sgnn/* 314235368Sgnn * TCP Fetch "port closed" ports 315235368Sgnn */ 316235368Sgnnfbt:ip:tcp_xchg:entry 317235368Sgnn/self->reset/ 318235368Sgnn{ 319235368Sgnn#if defined(_BIG_ENDIAN) 320235368Sgnn self->lport = (uint16_t)arg0; 321235368Sgnn self->fport = (uint16_t)arg1; 322235368Sgnn#else 323235368Sgnn self->lport = BSWAP_16((uint16_t)arg0); 324235368Sgnn self->fport = BSWAP_16((uint16_t)arg1); 325235368Sgnn#endif 326235368Sgnn self->lport = BE16_TO_U16(arg0); 327235368Sgnn self->fport = BE16_TO_U16(arg1); 328235368Sgnn} 329235368Sgnn 330235368Sgnn/* 331235368Sgnn * TCP Print "port closed" 332235368Sgnn */ 333235368Sgnnfbt:ip:tcp_xmit_early_reset:return 334235368Sgnn{ 335235368Sgnn self->name = "<closed>"; 336235368Sgnn self->pid = 0; 337235368Sgnn self->uid = 0; 338235368Sgnn self->proj = 0; 339235368Sgnn self->size = 54 * 2; /* should check trailers */ 340235368Sgnn OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, 341235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 342235368Sgnn OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, 343235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 344235368Sgnn OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, 345235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 346235368Sgnn self->reset = 0; 347235368Sgnn self->size = 0; 348235368Sgnn self->name = 0; 349235368Sgnn} 350235368Sgnn 351235368Sgnn/* 352235368Sgnn * TCP Process Write 353235368Sgnn */ 354235368Sgnnfbt:ip:tcp_send_data:entry 355235368Sgnn{ 356235368Sgnn self->conn_p = (conn_t *)args[0]->tcp_connp; 357235368Sgnn} 358235368Sgnn 359235368Sgnnfbt:ip:tcp_send_data:entry 360235368Sgnn/tok[(int)self->conn_p]/ 361235368Sgnn{ 362235368Sgnn self->size = msgdsize(args[2]) + 14; /* should check trailers */ 363235368Sgnn self->uid = tuid[(int)self->conn_p]; 364235368Sgnn self->laddr = tladdr[(int)self->conn_p]; 365235368Sgnn self->faddr = tfaddr[(int)self->conn_p]; 366235368Sgnn self->lport = tlport[(int)self->conn_p]; 367235368Sgnn self->fport = tfport[(int)self->conn_p]; 368235368Sgnn OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; 369235368Sgnn self->zoneid = self->conn_p->conn_zoneid; 370235368Sgnn self->ok = 2; 371235368Sgnn 372235368Sgnn /* follow inetd -> in.* transitions */ 373235368Sgnn self->name = pid && (tname[(int)self->conn_p] == "inetd") ? 374235368Sgnn execname : tname[(int)self->conn_p]; 375235368Sgnn self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? 376235368Sgnn pid : tpid[(int)self->conn_p]; 377235368Sgnn tname[(int)self->conn_p] = self->name; 378235368Sgnn tpid[(int)self->conn_p] = self->pid; 379235368Sgnn} 380235368Sgnn 381235368Sgnn/* 382235368Sgnn * TCP Process Read 383235368Sgnn */ 384235368Sgnnfbt:ip:tcp_rput_data:entry 385235368Sgnn{ 386235368Sgnn self->conn_p = (conn_t *)arg0; 387235368Sgnn self->size = msgdsize(args[1]) + 14; /* should check trailers */ 388235368Sgnn} 389235368Sgnn 390235368Sgnnfbt:ip:tcp_rput_data:entry 391235368Sgnn/tok[(int)self->conn_p]/ 392235368Sgnn{ 393235368Sgnn self->uid = tuid[(int)self->conn_p]; 394235368Sgnn self->laddr = tladdr[(int)self->conn_p]; 395235368Sgnn self->faddr = tfaddr[(int)self->conn_p]; 396235368Sgnn self->lport = tlport[(int)self->conn_p]; 397235368Sgnn self->fport = tfport[(int)self->conn_p]; 398235368Sgnn OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; 399235368Sgnn self->zoneid = self->conn_p->conn_zoneid; 400235368Sgnn self->ok = 2; 401235368Sgnn 402235368Sgnn /* follow inetd -> in.* transitions */ 403235368Sgnn self->name = pid && (tname[(int)self->conn_p] == "inetd") ? 404235368Sgnn execname : tname[(int)self->conn_p]; 405235368Sgnn self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? 406235368Sgnn pid : tpid[(int)self->conn_p]; 407235368Sgnn tname[(int)self->conn_p] = self->name; 408235368Sgnn tpid[(int)self->conn_p] = self->pid; 409235368Sgnn} 410235368Sgnn 411235368Sgnn/* 412235368Sgnn * TCP Complete printing outbound handshake 413235368Sgnn */ 414235368Sgnnfbt:ip:tcp_connect:return 415235368Sgnn/self->connp/ 416235368Sgnn{ 417235368Sgnn self->name = tname[(int)self->connp]; 418235368Sgnn self->pid = tpid[(int)self->connp]; 419235368Sgnn self->uid = tuid[(int)self->connp]; 420235368Sgnn self->zoneid = self->connp->conn_zoneid; 421235368Sgnn OPT_proj ? self->proj = tproj[(int)self->connp] : 1; 422235368Sgnn self->size = 54; /* should check trailers */ 423235368Sgnn 424235368Sgnn /* this packet occured before connp was fully established */ 425235368Sgnn OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, 426235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 427235368Sgnn OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, 428235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 429235368Sgnn OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, 430235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 431235368Sgnn} 432235368Sgnn 433235368Sgnn/* 434235368Sgnn * TCP Complete printing inbound handshake 435235368Sgnn */ 436235368Sgnnfbt:sockfs:sotpi_accept:return 437235368Sgnn/self->connp/ 438235368Sgnn{ 439235368Sgnn self->name = tname[(int)self->connp]; 440235368Sgnn self->pid = tpid[(int)self->connp]; 441235368Sgnn self->uid = tuid[(int)self->connp]; 442235368Sgnn self->zoneid = self->connp->conn_zoneid; 443235368Sgnn OPT_proj ? self->proj = tproj[(int)self->connp] : 1; 444235368Sgnn self->size = 54 * 3; /* should check trailers */ 445235368Sgnn 446235368Sgnn /* these packets occured before connp was fully established */ 447235368Sgnn OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, 448235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 449235368Sgnn OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, 450235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 451235368Sgnn OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, 452235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 453235368Sgnn} 454235368Sgnn 455235368Sgnn/* 456235368Sgnn * TCP Save data 457235368Sgnn */ 458235368Sgnnfbt:ip:tcp_send_data:entry, 459235368Sgnnfbt:ip:tcp_rput_data:entry 460235368Sgnn/self->ok == 2/ 461235368Sgnn{ 462235368Sgnn /* save r+w data*/ 463235368Sgnn OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, 464235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 465235368Sgnn OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, 466235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 467235368Sgnn OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, 468235368Sgnn self->faddr, self->fport, self->name] = sum(self->size) : 1; 469235368Sgnn} 470235368Sgnn 471235368Sgnn/* 472235368Sgnn * TCP Clear connect variables 473235368Sgnn */ 474235368Sgnnfbt:sockfs:sotpi_accept:return, 475235368Sgnnfbt:ip:tcp_connect:return 476235368Sgnn/self->connp/ 477235368Sgnn{ 478235368Sgnn self->faddr = 0; 479235368Sgnn self->laddr = 0; 480235368Sgnn self->fport = 0; 481235368Sgnn self->lport = 0; 482235368Sgnn self->connp = 0; 483235368Sgnn self->name = 0; 484235368Sgnn self->pid = 0; 485235368Sgnn self->uid = 0; 486235368Sgnn} 487235368Sgnn 488235368Sgnn/* 489235368Sgnn * TCP Clear r/w variables 490235368Sgnn */ 491235368Sgnnfbt:ip:tcp_send_data:entry, 492235368Sgnnfbt:ip:tcp_rput_data:entry 493235368Sgnn{ 494235368Sgnn self->ok = 0; 495235368Sgnn self->uid = 0; 496235368Sgnn self->pid = 0; 497235368Sgnn self->size = 0; 498235368Sgnn self->name = 0; 499235368Sgnn self->lport = 0; 500235368Sgnn self->fport = 0; 501235368Sgnn self->laddr = 0; 502235368Sgnn self->faddr = 0; 503235368Sgnn self->conn_p = 0; 504235368Sgnn self->zoneid = 0; 505235368Sgnn self->proj = 0; 506235368Sgnn} 507235368Sgnn 508235368Sgnn/* 509235368Sgnn * TCP Systemwide Stats 510235368Sgnn */ 511235368Sgnnmib:::tcpOutDataBytes { TCP_out += args[0]; } 512235368Sgnnmib:::tcpRetransBytes { TCP_out += args[0]; } 513235368Sgnnmib:::tcpInDataInorderBytes { TCP_in += args[0]; } 514235368Sgnnmib:::tcpInDataDupBytes { TCP_in += args[0]; } 515235368Sgnnmib:::tcpInDataUnorderBytes { TCP_in += args[0]; } 516235368Sgnn 517235368Sgnn/* 518235368Sgnn * Timer 519235368Sgnn */ 520235368Sgnnprofile:::tick-1sec 521235368Sgnn{ 522235368Sgnn secs--; 523235368Sgnn} 524235368Sgnn 525235368Sgnn/* 526235368Sgnn * Print Report 527235368Sgnn */ 528235368Sgnnprofile:::tick-1sec 529235368Sgnn/secs == 0/ 530235368Sgnn{ 531235368Sgnn /* fetch 1 min load average */ 532235368Sgnn this->load1a = `hp_avenrun[0] / 65536; 533235368Sgnn this->load1b = ((`hp_avenrun[0] % 65536) * 100) / 65536; 534235368Sgnn 535235368Sgnn /* convert TCP counters to Kbytes */ 536235368Sgnn TCP_out /= 1024; 537235368Sgnn TCP_in /= 1024; 538235368Sgnn 539235368Sgnn /* print status */ 540235368Sgnn OPT_clear ? printf("%s", CLEAR) : 1; 541235368Sgnn printf("%Y, load: %d.%02d, TCPin: %6d KB, TCPout: %6d KB\n\n", 542235368Sgnn walltimestamp, this->load1a, this->load1b, TCP_in, TCP_out); 543235368Sgnn 544235368Sgnn /* print headers */ 545235368Sgnn OPT_def ? printf(" UID ") : 1; 546235368Sgnn OPT_proj ? printf("PROJ ") : 1; 547235368Sgnn OPT_zone ? printf("ZONE ") : 1; 548235368Sgnn printf("%6s %-15s %5s %-15s %5s %9s %s\n", 549235368Sgnn "PID", "LADDR", "LPORT", "RADDR", "RPORT", "SIZE", "NAME"); 550235368Sgnn 551235368Sgnn /* print data */ 552235368Sgnn printa("%4d %6d %-15s %5d %-15s %5d %@9d %s\n", @out); 553235368Sgnn printf("\n"); 554235368Sgnn 555235368Sgnn /* clear data */ 556235368Sgnn trunc(@out); 557235368Sgnn TCP_in = 0; 558235368Sgnn TCP_out = 0; 559235368Sgnn secs = INTERVAL; 560235368Sgnn counts--; 561235368Sgnn} 562235368Sgnn 563235368Sgnn/* 564235368Sgnn * End of program 565235368Sgnn */ 566235368Sgnnprofile:::tick-1sec 567235368Sgnn/counts == 0/ 568235368Sgnn{ 569235368Sgnn exit(0); 570235368Sgnn} 571235368Sgnn 572235368Sgnn/* 573235368Sgnn * Cleanup for Ctrl-C 574235368Sgnn */ 575235368Sgnndtrace:::END 576235368Sgnn{ 577235368Sgnn trunc(@out); 578235368Sgnn} 579235368Sgnn') 580