1N/A#!/usr/sbin/dtrace -s
1N/A/*
1N/A * tcpwdist.d - simple TCP write distribution by process.
1N/A * Written in DTrace (Solaris 10 3/05).
1N/A *
1N/A * This measures the size of writes from applications to the TCP level, which
1N/A * may well be much larger than the MTU size (this is application writes not
1N/A * packet writes). It can help identify which process is creating network
1N/A * traffic, and the size of the writes by that application. It uses a simple
1N/A * probe that produces meaningful output for most protocols.
1N/A *
1N/A * Tracking TCP activity by process is complex for a number of reasons,
1N/A * the greatest is that inbound TCP traffic is asynchronous to the process.
1N/A * The easiest TCP traffic to match is writes, which this script demonstrates.
1N/A * However there are still issues - for an inbound telnet connection the
1N/A * writes are associated with the command, for example "ls -l", not something
1N/A * meaningful such as "in.telnetd".
1N/A *
1N/A * Scripts that match TCP traffic properly include tcpsnoop and tcptop.
1N/A *
1N/A * $Id: tcpwdist.d 3 2007-08-01 10:50:08Z brendan $
1N/A *
1N/A * USAGE: tcpwdist.d # wait several seconds, then hit Ctrl-C
1N/A *
1N/A * FIELDS:
1N/A * PID process ID
1N/A * CMD command and argument list
1N/A * value TCP write payload size in bytes
1N/A * count number of writes
1N/A *
1N/A * SEE ALSO: tcpsnoop, tcptop
1N/A *
1N/A * COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg.
1N/A *
1N/A * CDDL HEADER START
1N/A *
1N/A * The contents of this file are subject to the terms of the
1N/A * Common Development and Distribution License, Version 1.0 only
1N/A * (the "License"). You may not use this file except in compliance
1N/A * with the License.
1N/A *
1N/A * You can obtain a copy of the license at Docs/cddl1.txt
1N/A * or http://www.opensolaris.org/os/licensing.
1N/A * See the License for the specific language governing permissions
1N/A * and limitations under the License.
1N/A *
1N/A * CDDL HEADER END
1N/A *
1N/A * 09-Jul-2004 Brendan Gregg Created this.
1N/A * 14-Jun-2005 " " Rewrote this as tcpwdist.d.
1N/A * 20-Apr-2006 " " Last update.
1N/A */
1N/A
1N/A#pragma D option quiet
1N/A
1N/A/*
1N/A * Print header
1N/A */
1N/Adtrace:::BEGIN
1N/A{
1N/A printf("Tracing... Hit Ctrl-C to end.\n");
1N/A}
1N/A
1N/A/*
1N/A * Process TCP Write
1N/A */
1N/Afbt:ip:tcp_output:entry
1N/A{
1N/A /* fetch details */
1N/A this->size = msgdsize(args[1]);
1N/A
1N/A /* store details */
1N/A @Size[pid, curpsinfo->pr_psargs] = quantize(this->size);
1N/A}
1N/A
1N/A/*
1N/A * Print final report
1N/A */
1N/Adtrace:::END
1N/A{
1N/A printa(" PID: %-6d CMD: %S\n%@d\n", @Size);
1N/A}