1N/A#!/usr/bin/ksh
1N/A#
1N/A# tcpsnoop_snv - snoop TCP network packets by process.
1N/A# Written using DTrace (Solaris Nevada)
1N/A#
1N/A# This analyses TCP network packets and prints the responsible PID and UID,
1N/A# plus standard details such as IP address and port. This captures traffic
1N/A# of newly created TCP connections that were established while this program
1N/A# was running. It can help identify which processes is causing TCP traffic.
1N/A#
1N/A# WARNING: This script may only work on Solaris Nevada and OpenSolaris
1N/A# of the late 2007 vintage, since it uses the fbt provider to trace the raw
1N/A# operation of a specific version of the kernel. In the future, a 'stable'
1N/A# network provider should exist which will allow this to be written for that
1N/A# and subsequent versions of the kernel. In the meantime, check for other
1N/A# versions of this script in the /Net directory, and read the
1N/A# Notes/ALLfbt_notes.txt for more background on fbt.
1N/A#
1N/A# $Id: tcpsnoop_snv 69 2007-10-04 13:40:00Z brendan $
1N/A#
1N/A# USAGE: tcpsnoop [-a|hjsvZ] [-n name] [-p pid]
1N/A#
1N/A# -a # print all data
1N/A# -j # print project ID
1N/A# -s # print time, us
1N/A# -v # print time, string
1N/A# -Z # print zone ID
1N/A# -n name # command name to snoop
1N/A# -p pid # PID to snoop
1N/A# eg,
1N/A# tcpsnoop -v # human readable timestamps
1N/A# tcpsnoop -Z # print zonename
1N/A# tcpsnoop -n sshd # snoop sshd traffic only
1N/A#
1N/A# FIELDS:
1N/A# UID user ID
1N/A# PID process ID
1N/A# CMD command
1N/A# LADDR local IP address
1N/A# RADDR remote IP address
1N/A# LPORT local port number
1N/A# RPORT remote port number
1N/A# DR direction
1N/A# SIZE packet size, bytes
1N/A# TIME timestamp, us
1N/A# STRTIME human readable timestamp, string
1N/A# ZONE zone ID
1N/A# PROJ project ID
1N/A#
1N/A# SEE ALSO: snoop -rS
1N/A#
1N/A# COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg.
1N/A#
1N/A# CDDL HEADER START
1N/A#
1N/A# The contents of this file are subject to the terms of the
1N/A# Common Development and Distribution License, Version 1.0 only
1N/A# (the "License"). You may not use this file except in compliance
1N/A# with the License.
1N/A#
1N/A# You can obtain a copy of the license at Docs/cddl1.txt
1N/A# or http://www.opensolaris.org/os/licensing.
1N/A# See the License for the specific language governing permissions
1N/A# and limitations under the License.
1N/A#
1N/A# CDDL HEADER END
1N/A#
1N/A# Author: Brendan Gregg [Sydney, Australia]
1N/A#
1N/A# TODO: IPv6
1N/A#
1N/A# CODE:
1N/A# The FILTER syntax matches on packets rather than initial
1N/A# connections, so that it can follow inetd connections properly.
1N/A#
1N/A# 09-Jul-2004 Brendan Gregg Created this.
1N/A# 12-Mar-2005 " " Changed probes, size info now printed.
1N/A# 02-Jul-2005 " " Many more probes. Renamed "tcpsnoop.d".
1N/A# 04-Jul-2005 " " Now wrapped in shell, called "tcpsnoop".
1N/A# 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct
1N/A# execname. Thanks Kias Belgaied for expertise.
1N/A# 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+.
1N/A# 20-Apr-2006 " " Last update.
1N/A# 30-Sep-2007 " " Bumped this for recent OpenSolaris/Nevada.
1N/A#
1N/A
1N/A##############################
1N/A# --- Process Arguments ---
1N/A#
1N/A
1N/A### default variables
1N/Aopt_name=0; opt_time=0; opt_timestr=0; filter=0; pname=.
1N/Aopt_zone=0; opt_proj=0; opt_pid=0; pid=0
1N/A
1N/A### process options
1N/Awhile getopts ahjsvZn:p: name
1N/Ado
1N/A case $name in
1N/A a) opt_time=1; opt_timestr=1; opt_zone=1; opt_proj=1 ;;
1N/A n) opt_name=1; pname=$OPTARG ;;
1N/A p) opt_pid=1; pid=$OPTARG ;;
1N/A j) opt_proj=1 ;;
1N/A s) opt_time=1 ;;
1N/A v) opt_timestr=1 ;;
1N/A Z) opt_zone=1 ;;
1N/A h|?) cat <<-END >&2
1N/A USAGE: tcpsnoop [-a|hjsvZ] [-n name] [-p pid]
1N/A tcpsnoop # default output
1N/A -a # print all data
1N/A -j # print project ID
1N/A -s # print start time, us
1N/A -v # print start time, string
1N/A -Z # print zonename
1N/A -n name # command name to snoop
1N/A -p pid # PID to snoop
1N/A eg,
1N/A tcpsnoop -v # human readable timestamps
1N/A tcpsnoop -Z # print zonename
1N/A tcpsnoop -n sshd # snoop sshd traffic only
1N/A END
1N/A exit 1
1N/A esac
1N/Adone
1N/A
1N/A### option logic
1N/Aif (( opt_name || opt_pid )); then
1N/A filter=1
1N/Afi
1N/A
1N/A#################################
1N/A# --- Main Program, DTrace ---
1N/A#
1N/A/usr/sbin/dtrace -Cs <( print -r '
1N/A /*
1N/A * Command line arguments
1N/A */
1N/A inline int OPT_name = '$opt_name';
1N/A inline int OPT_pid = '$opt_pid';
1N/A inline int OPT_time = '$opt_time';
1N/A inline int OPT_timestr = '$opt_timestr';
1N/A inline int OPT_zone = '$opt_zone';
1N/A inline int OPT_proj = '$opt_proj';
1N/A inline int PID = '$pid';
1N/A inline int FILTER = '$filter';
1N/A inline string NAME = "'$pname'";
1N/A
1N/A#pragma D option quiet
1N/A#pragma D option switchrate=10hz
1N/A
1N/A#include <sys/file.h>
1N/A#include <inet/common.h>
1N/A#include <sys/byteorder.h>
1N/A#include <sys/socket.h>
1N/A#include <sys/socketvar.h>
1N/A
1N/A/*
1N/A * Print header
1N/A */
1N/Adtrace:::BEGIN
1N/A{
1N/A /* print optional headers */
1N/A OPT_time ? printf("%-14s ", "TIME") : 1;
1N/A OPT_timestr ? printf("%-20s ", "STRTIME") : 1;
1N/A OPT_zone ? printf("%4s ", "ZONE") : 1;
1N/A OPT_proj ? printf("%4s ", "PROJ") : 1;
1N/A
1N/A /* print main headers */
1N/A printf("%5s %6s %-15s %5s %2s %-15s %5s %5s %s\n",
1N/A "UID", "PID", "LADDR", "LPORT", "DR", "RADDR", "RPORT",
1N/A "SIZE", "CMD");
1N/A}
1N/A
1N/A
1N/A/*
1N/A * TCP Process inbound connections
1N/A *
1N/A * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was
1N/A * renamed to SS_DIRECT around build 31.
1N/A */
1N/Afbt:sockfs:sotpi_accept:entry
1N/A/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/
1N/A{
1N/A self->sop = args[0];
1N/A}
1N/A
1N/Afbt:sockfs:sotpi_create:return
1N/A/self->sop/
1N/A{
1N/A self->nsop = (struct sonode *)arg1;
1N/A}
1N/A
1N/Afbt:sockfs:sotpi_accept:return
1N/A/self->nsop/
1N/A{
1N/A this->tcpp = (tcp_t *)self->nsop->so_priv;
1N/A self->connp = (conn_t *)this->tcpp->tcp_connp;
1N/A tname[(int)self->connp] = execname;
1N/A tpid[(int)self->connp] = pid;
1N/A tuid[(int)self->connp] = uid;
1N/A}
1N/A
1N/Afbt:sockfs:sotpi_accept:return
1N/A{
1N/A self->nsop = 0;
1N/A self->sop = 0;
1N/A}
1N/A
1N/A/*
1N/A * TCP Process outbound connections
1N/A */
1N/Afbt:ip:tcp_connect:entry
1N/A{
1N/A this->tcpp = (tcp_t *)arg0;
1N/A self->connp = (conn_t *)this->tcpp->tcp_connp;
1N/A tname[(int)self->connp] = execname;
1N/A tpid[(int)self->connp] = pid;
1N/A tuid[(int)self->connp] = uid;
1N/A OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1;
1N/A}
1N/A
1N/A/*
1N/A * TCP Data translations
1N/A */
1N/Afbt:sockfs:sotpi_accept:return,
1N/Afbt:ip:tcp_connect:return
1N/A/self->connp/
1N/A{
1N/A /* fetch ports */
1N/A#if defined(_BIG_ENDIAN)
1N/A self->lport = self->connp->u_port.tcpu_ports.tcpu_lport;
1N/A self->fport = self->connp->u_port.tcpu_ports.tcpu_fport;
1N/A#else
1N/A self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport);
1N/A self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport);
1N/A#endif
1N/A
1N/A /* fetch IPv4 addresses */
1N/A this->fad12 =
1N/A (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12];
1N/A this->fad13 =
1N/A (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13];
1N/A this->fad14 =
1N/A (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14];
1N/A this->fad15 =
1N/A (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15];
1N/A this->lad12 =
1N/A (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12];
1N/A this->lad13 =
1N/A (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13];
1N/A this->lad14 =
1N/A (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14];
1N/A this->lad15 =
1N/A (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15];
1N/A
1N/A /* convert type for use with lltostr() */
1N/A this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12;
1N/A this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13;
1N/A this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14;
1N/A this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15;
1N/A this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12;
1N/A this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13;
1N/A this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14;
1N/A this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15;
1N/A
1N/A /* stringify addresses */
1N/A self->faddr = strjoin(lltostr(this->fad12), ".");
1N/A self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
1N/A self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
1N/A self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
1N/A self->laddr = strjoin(lltostr(this->lad12), ".");
1N/A self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
1N/A self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
1N/A self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
1N/A
1N/A /* fix direction and save values */
1N/A tladdr[(int)self->connp] = self->laddr;
1N/A tfaddr[(int)self->connp] = self->faddr;
1N/A tlport[(int)self->connp] = self->lport;
1N/A tfport[(int)self->connp] = self->fport;
1N/A
1N/A /* all systems go */
1N/A tok[(int)self->connp] = 1;
1N/A}
1N/A
1N/A/*
1N/A * TCP Clear connp
1N/A */
1N/Afbt:ip:tcp_get_conn:return
1N/A{
1N/A /* Q_TO_CONN */
1N/A this->connp = (conn_t *)arg1;
1N/A tok[(int)this->connp] = 0;
1N/A tpid[(int)this->connp] = 0;
1N/A tuid[(int)this->connp] = 0;
1N/A tname[(int)this->connp] = 0;
1N/A tproj[(int)this->connp] = 0;
1N/A}
1N/A
1N/A/*
1N/A * TCP Process "port closed"
1N/A */
1N/Afbt:ip:tcp_xmit_early_reset:entry
1N/A/FILTER == 0/
1N/A{
1N/A this->queuep = args[7]->tcps_g_q;
1N/A this->connp = (conn_t *)this->queuep->q_ptr;
1N/A this->tcpp = (tcp_t *)this->connp->conn_tcp;
1N/A self->zoneid = this->connp->conn_zoneid;
1N/A
1N/A /* split addresses */
1N/A this->ipha = (ipha_t *)args[1]->b_rptr;
1N/A this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24;
1N/A this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16;
1N/A this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8;
1N/A this->fad12 = (this->ipha->ipha_src & 0x000000ff);
1N/A this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24;
1N/A this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16;
1N/A this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8;
1N/A this->lad12 = (this->ipha->ipha_dst & 0x000000ff);
1N/A
1N/A /* stringify addresses */
1N/A self->faddr = strjoin(lltostr(this->fad12), ".");
1N/A self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), "."));
1N/A self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), "."));
1N/A self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0));
1N/A self->laddr = strjoin(lltostr(this->lad12), ".");
1N/A self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), "."));
1N/A self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), "."));
1N/A self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0));
1N/A
1N/A self->reset = 1;
1N/A}
1N/A
1N/A/*
1N/A * TCP Fetch "port closed" ports
1N/A */
1N/Afbt:ip:tcp_xchg:entry
1N/A/self->reset/
1N/A{
1N/A#if defined(_BIG_ENDIAN)
1N/A self->lport = (uint16_t)arg0;
1N/A self->fport = (uint16_t)arg1;
1N/A#else
1N/A self->lport = BSWAP_16((uint16_t)arg0);
1N/A self->fport = BSWAP_16((uint16_t)arg1);
1N/A#endif
1N/A self->lport = BE16_TO_U16(arg0);
1N/A self->fport = BE16_TO_U16(arg1);
1N/A}
1N/A
1N/A/*
1N/A * TCP Print "port closed"
1N/A */
1N/Afbt:ip:tcp_xmit_early_reset:return
1N/A/FILTER == 0/
1N/A{
1N/A self->name = "<closed>";
1N/A self->pid = 0;
1N/A self->uid = 0;
1N/A self->proj = 0;
1N/A self->size = 54; /* should check trailers */
1N/A self->dir = "<-";
1N/A OPT_time ? printf("%-14d ", timestamp/1000) : 1;
1N/A OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
1N/A OPT_zone ? printf("%4d ", self->zoneid) : 1;
1N/A OPT_proj ? printf("%4d ", self->proj) : 1;
1N/A printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
1N/A self->uid, self->pid, self->laddr, self->lport, self->dir,
1N/A self->faddr, self->fport, self->size, self->name);
1N/A self->dir = "->";
1N/A OPT_time ? printf("%-14d ", timestamp/1000) : 1;
1N/A OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
1N/A OPT_zone ? printf("%4d ", self->zoneid) : 1;
1N/A OPT_proj ? printf("%4d ", self->proj) : 1;
1N/A printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
1N/A self->uid, self->pid, self->laddr, self->lport, self->dir,
1N/A self->faddr, self->fport, self->size, self->name);
1N/A self->reset = 0;
1N/A self->size = 0;
1N/A self->name = 0;
1N/A self->zoneid = 0;
1N/A}
1N/A
1N/A/*
1N/A * TCP Process Write
1N/A */
1N/Afbt:ip:tcp_send_data:entry
1N/A{
1N/A self->conn_p = (conn_t *)args[0]->tcp_connp;
1N/A}
1N/A
1N/Afbt:ip:tcp_send_data:entry
1N/A/tok[(int)self->conn_p]/
1N/A{
1N/A self->dir = "->";
1N/A self->size = msgdsize(args[2]) + 14; /* should check trailers */
1N/A self->uid = tuid[(int)self->conn_p];
1N/A self->laddr = tladdr[(int)self->conn_p];
1N/A self->faddr = tfaddr[(int)self->conn_p];
1N/A self->lport = tlport[(int)self->conn_p];
1N/A self->fport = tfport[(int)self->conn_p];
1N/A OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1;
1N/A self->zoneid = self->conn_p->conn_zoneid;
1N/A self->ok = 2;
1N/A
1N/A /* follow inetd -> in.* transitions */
1N/A self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
1N/A execname : tname[(int)self->conn_p];
1N/A self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
1N/A pid : tpid[(int)self->conn_p];
1N/A tname[(int)self->conn_p] = self->name;
1N/A tpid[(int)self->conn_p] = self->pid;
1N/A}
1N/A
1N/A/*
1N/A * TCP Process Read
1N/A */
1N/Afbt:ip:tcp_rput_data:entry
1N/A{
1N/A self->conn_p = (conn_t *)arg0;
1N/A self->size = msgdsize(args[1]) + 14; /* should check trailers */
1N/A}
1N/A
1N/Afbt:ip:tcp_rput_data:entry
1N/A/tok[(int)self->conn_p]/
1N/A{
1N/A self->dir = "<-";
1N/A self->uid = tuid[(int)self->conn_p];
1N/A self->laddr = tladdr[(int)self->conn_p];
1N/A self->faddr = tfaddr[(int)self->conn_p];
1N/A self->lport = tlport[(int)self->conn_p];
1N/A self->fport = tfport[(int)self->conn_p];
1N/A OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1;
1N/A self->zoneid = self->conn_p->conn_zoneid;
1N/A self->ok = 2;
1N/A
1N/A /* follow inetd -> in.* transitions */
1N/A self->name = pid && (tname[(int)self->conn_p] == "inetd") ?
1N/A execname : tname[(int)self->conn_p];
1N/A self->pid = pid && (tname[(int)self->conn_p] == "inetd") ?
1N/A pid : tpid[(int)self->conn_p];
1N/A tname[(int)self->conn_p] = self->name;
1N/A tpid[(int)self->conn_p] = self->pid;
1N/A}
1N/A
1N/A/*
1N/A * TCP Complete printing outbound handshake
1N/A */
1N/Afbt:ip:tcp_connect:return
1N/A/self->connp/
1N/A{
1N/A self->name = tname[(int)self->connp];
1N/A self->pid = tpid[(int)self->connp];
1N/A self->uid = tuid[(int)self->connp];
1N/A self->zoneid = self->connp->conn_zoneid;
1N/A OPT_proj ? self->proj = tproj[(int)self->connp] : 1;
1N/A self->size = 54; /* should check trailers */
1N/A self->dir = "->";
1N/A}
1N/A
1N/Afbt:ip:tcp_connect:return
1N/A/(self->connp) &&
1N/A ((FILTER == 0) ||
1N/A (OPT_pid && self->pid == PID) ||
1N/A (OPT_name && self->name == NAME))/
1N/A{
1N/A /* this packet occured before connp was fully established */
1N/A OPT_time ? printf("%-14d ", timestamp/1000) : 1;
1N/A OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
1N/A OPT_zone ? printf("%4d ", self->zoneid) : 1;
1N/A OPT_proj ? printf("%4d ", self->proj) : 1;
1N/A printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
1N/A self->uid, self->pid, self->laddr, self->lport, self->dir,
1N/A self->faddr, self->fport, self->size, self->name);
1N/A}
1N/A
1N/A/*
1N/A * TCP Complete printing inbound handshake
1N/A */
1N/Afbt:sockfs:sotpi_accept:return
1N/A/self->connp/
1N/A{
1N/A self->name = tname[(int)self->connp];
1N/A self->pid = tpid[(int)self->connp];
1N/A self->uid = tuid[(int)self->connp];
1N/A self->zoneid = self->connp->conn_zoneid;
1N/A OPT_proj ? self->proj = tproj[(int)self->connp] : 1;
1N/A self->size = 54; /* should check trailers */
1N/A self->dir = "<-";
1N/A}
1N/A
1N/Afbt:sockfs:sotpi_accept:return
1N/A/(self->connp) &&
1N/A ((FILTER == 0) ||
1N/A (OPT_pid && self->pid == PID) ||
1N/A (OPT_name && self->name == NAME))/
1N/A{
1N/A /* these packets occured before connp was fully established */
1N/A OPT_time ? printf("%-14d ", timestamp/1000) : 1;
1N/A OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
1N/A OPT_zone ? printf("%4d ", self->zoneid) : 1;
1N/A OPT_proj ? printf("%4d ", self->proj) : 1;
1N/A printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
1N/A self->uid, self->pid, self->laddr, self->lport, self->dir,
1N/A self->faddr, self->fport, self->size, self->name);
1N/A self->dir = "->";
1N/A OPT_time ? printf("%-14d ", timestamp/1000) : 1;
1N/A OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
1N/A OPT_zone ? printf("%4d ", self->zoneid) : 1;
1N/A OPT_proj ? printf("%4d ", self->proj) : 1;
1N/A printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
1N/A self->uid, self->pid, self->laddr, self->lport, self->dir,
1N/A self->faddr, self->fport, self->size, self->name);
1N/A self->dir = "<-";
1N/A OPT_time ? printf("%-14d ", timestamp/1000) : 1;
1N/A OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
1N/A OPT_zone ? printf("%4d ", self->zoneid) : 1;
1N/A OPT_proj ? printf("%4d ", self->proj) : 1;
1N/A printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
1N/A self->uid, self->pid, self->laddr, self->lport, self->dir,
1N/A self->faddr, self->fport, self->size, self->name);
1N/A}
1N/A
1N/A/*
1N/A * Print output
1N/A */
1N/Afbt:ip:tcp_send_data:entry,
1N/Afbt:ip:tcp_rput_data:entry
1N/A/(self->ok == 2) &&
1N/A ((FILTER == 0) ||
1N/A (OPT_pid && self->pid == PID) ||
1N/A (OPT_name && self->name == NAME))/
1N/A{
1N/A /* print optional fields */
1N/A OPT_time ? printf("%-14d ", timestamp/1000) : 1;
1N/A OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;
1N/A OPT_zone ? printf("%4d ", self->zoneid) : 1;
1N/A OPT_proj ? printf("%4d ", self->proj) : 1;
1N/A
1N/A /* print output line */
1N/A printf("%5d %6d %-15s %5d %2s %-15s %5d %5d %s\n",
1N/A self->uid, self->pid, self->laddr, self->lport, self->dir,
1N/A self->faddr, self->fport, self->size, self->name);
1N/A}
1N/A
1N/A/*
1N/A * TCP Clear connect variables
1N/A */
1N/Afbt:sockfs:sotpi_accept:return,
1N/Afbt:ip:tcp_connect:return
1N/A/self->connp/
1N/A{
1N/A self->faddr = 0;
1N/A self->laddr = 0;
1N/A self->fport = 0;
1N/A self->lport = 0;
1N/A self->connp = 0;
1N/A self->name = 0;
1N/A self->pid = 0;
1N/A self->uid = 0;
1N/A}
1N/A
1N/A/*
1N/A * TCP Clear r/w variables
1N/A */
1N/Afbt:ip:tcp_send_data:entry,
1N/Afbt:ip:tcp_rput_data:entry
1N/A{
1N/A self->ok = 0;
1N/A self->dir = 0;
1N/A self->uid = 0;
1N/A self->pid = 0;
1N/A self->size = 0;
1N/A self->name = 0;
1N/A self->lport = 0;
1N/A self->fport = 0;
1N/A self->laddr = 0;
1N/A self->faddr = 0;
1N/A self->conn_p = 0;
1N/A self->zoneid = 0;
1N/A self->proj = 0;
1N/A}
1N/A')