1N/A# tcptop_snv - display top TCP network packets by process. 1N/A# Written using DTrace (Solaris Nevada) 1N/A# This analyses TCP network packets and prints the responsible PID and UID, 1N/A# plus standard details such as IP address and port. This captures traffic 1N/A# of newly created TCP connections that were established while this program 1N/A# was running. It can help identify which processes is causing TCP traffic. 1N/A# WARNING: This script may only work on Solaris Nevada and OpenSolaris 1N/A# of the late 2007 vintage, since it uses the fbt provider to trace the raw 1N/A# operation of a specific version of the kernel. In the future, a 'stable' 1N/A# network provider should exist which will allow this to be written for that 1N/A# and subsequent versions of the kernel. In the meantime, check for other 1N/A# versions of this script in the /Net directory, and read the 1N/A# $Id: tcptop_snv 69 2007-10-04 13:40:00Z brendan $ 1N/A# USAGE: tcptop [-Ch] [-j|-Z] [interval [count]] 1N/A# -C # don't clear the screen 1N/A# -j # print project IDs 1N/A# -Z # print zone IDs 1N/A# LADDR local IP address 1N/A# RADDR remote IP address 1N/A# LPORT local port number 1N/A# RPORT remote port number 1N/A# SIZE packet size, bytes 1N/A# load 1 min load average 1N/A# TCPin TCP inbound payload data 1N/A# TCPout TCP outbound payload data 1N/A# COPYRIGHT: Copyright (c) 2005, 2006 Brendan Gregg. 1N/A# The contents of this file are subject to the terms of the 1N/A# Common Development and Distribution License, Version 1.0 only 1N/A# (the "License"). You may not use this file except in compliance 1N/A# See the License for the specific language governing permissions 1N/A# and limitations under the License. 1N/A# Author: Brendan Gregg [Sydney, Australia] 1N/A# 05-Jul-2005 Brendan Gregg Created this. 1N/A# 03-Dec-2005 " " Fixed tcp_accept_finish bug, now 100% correct 1N/A# execname. Thanks Kias Belgaied for expertise. 1N/A# 20-Apr-2006 " " Fixed SS_TCP_FAST_ACCEPT bug in build 31+. 1N/A# 20-Apr-2006 " " Last update. 1N/A############################## 1N/A# --- Process Arguments --- 1N/A### default variables 1N/A USAGE: tcptop [-h] [-j|-Z] [interval [count]] 1N/A tcptop # default output 1N/A -C # don't clear the screen 1N/A -j # print project ID 1N/A tcptop # default is 5 sec interval 1N/A tcptop 2 # 2 second interval 1N/A tcptop -C 1 10 # 10 x 1 sec samples, no clear 1N/Ashift $(( $OPTIND - 1 )) 1N/Aif [[ "$1" > 0 ]]; then 1N/Aif [[ "$1" > 0 ]]; then 1N/Aif (( opt_proj && opt_zone )); then 1N/Aif (( opt_clear )); then 1N/A################################# 1N/A# --- Main Program, DTrace --- 1N/A/usr/sbin/dtrace -Cs <( print -r ' 1N/A * Command line arguments 1N/A inline int OPT_def = '$opt_def'; 1N/A inline int OPT_zone = '$opt_zone'; 1N/A inline int OPT_proj = '$opt_proj'; 1N/A inline int OPT_clear = '$opt_clear'; 1N/A inline int INTERVAL = '$interval'; 1N/A inline int COUNTER = '$count'; 1N/A inline string CLEAR = "'$clearstr'"; 1N/A#pragma D option quiet 1N/A#pragma D option switchrate=10hz 1N/A#include <sys/file.h> 1N/A#include <inet/common.h> 1N/A#include <sys/byteorder.h> 1N/A#include <sys/socket.h> 1N/A#include <sys/socketvar.h> 1N/A /* starting values */ 1N/A printf("Tracing... Please wait.\n"); 1N/A * TCP Process inbound connections 1N/A * 0x00200000 has been hardcoded. It was SS_TCP_FAST_ACCEPT, but was 1N/A * renamed to SS_DIRECT around build 31. 1N/Afbt:sockfs:sotpi_accept:entry 1N/A/(arg1 & FREAD) && (arg1 & FWRITE) && (args[0]->so_state & 0x00200000)/ 1N/A self->sop = args[0]; 1N/Afbt:sockfs:sotpi_create:return 1N/A self->nsop = (struct sonode *)arg1; 1N/Afbt:sockfs:sotpi_accept:return 1N/A this->tcpp = (tcp_t *)self->nsop->so_priv; 1N/A self->connp = (conn_t *)this->tcpp->tcp_connp; 1N/A tname[(int)self->connp] = execname; 1N/A tpid[(int)self->connp] = pid; 1N/A tuid[(int)self->connp] = uid; 1N/Afbt:sockfs:sotpi_accept:return 1N/A * TCP Process outbound connections 1N/Afbt:ip:tcp_connect:entry 1N/A this->tcpp = (tcp_t *)arg0; 1N/A self->connp = (conn_t *)this->tcpp->tcp_connp; 1N/A tname[(int)self->connp] = execname; 1N/A tpid[(int)self->connp] = pid; 1N/A tuid[(int)self->connp] = uid; 1N/A OPT_proj ? tproj[(int)self->connp] = curpsinfo->pr_projid : 1; 1N/A * TCP Data translations 1N/Afbt:sockfs:sotpi_accept:return, 1N/Afbt:ip:tcp_connect:return 1N/A#if defined(_BIG_ENDIAN) 1N/A self->lport = self->connp->u_port.tcpu_ports.tcpu_lport; 1N/A self->fport = self->connp->u_port.tcpu_ports.tcpu_fport; 1N/A self->lport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_lport); 1N/A self->fport = BSWAP_16(self->connp->u_port.tcpu_ports.tcpu_fport); 1N/A /* fetch IPv4 addresses */ 1N/A (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[12]; 1N/A (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[13]; 1N/A (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[14]; 1N/A (int)self->connp->connua_v6addr.connua_faddr._S6_un._S6_u8[15]; 1N/A (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[12]; 1N/A (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[13]; 1N/A (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[14]; 1N/A (int)self->connp->connua_v6addr.connua_laddr._S6_un._S6_u8[15]; 1N/A /* convert type for use with lltostr() */ 1N/A this->fad12 = this->fad12 < 0 ? 256 + this->fad12 : this->fad12; 1N/A this->fad13 = this->fad13 < 0 ? 256 + this->fad13 : this->fad13; 1N/A this->fad14 = this->fad14 < 0 ? 256 + this->fad14 : this->fad14; 1N/A this->fad15 = this->fad15 < 0 ? 256 + this->fad15 : this->fad15; 1N/A this->lad12 = this->lad12 < 0 ? 256 + this->lad12 : this->lad12; 1N/A this->lad13 = this->lad13 < 0 ? 256 + this->lad13 : this->lad13; 1N/A this->lad14 = this->lad14 < 0 ? 256 + this->lad14 : this->lad14; 1N/A this->lad15 = this->lad15 < 0 ? 256 + this->lad15 : this->lad15; 1N/A /* stringify addresses */ 1N/A self->faddr = strjoin(lltostr(this->fad12), "."); 1N/A self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); 1N/A self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); 1N/A self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); 1N/A self->laddr = strjoin(lltostr(this->lad12), "."); 1N/A self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); 1N/A self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); 1N/A self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); 1N/A /* fix direction and save values */ 1N/A tladdr[(int)self->connp] = self->laddr; 1N/A tfaddr[(int)self->connp] = self->faddr; 1N/A tlport[(int)self->connp] = self->lport; 1N/A tfport[(int)self->connp] = self->fport; 1N/A /* all systems go */ 1N/A tok[(int)self->connp] = 1; 1N/Afbt:ip:tcp_get_conn:return 1N/A this->connp = (conn_t *)arg1; 1N/A tok[(int)this->connp] = 0; 1N/A tpid[(int)this->connp] = 0; 1N/A tuid[(int)this->connp] = 0; 1N/A tname[(int)this->connp] = 0; 1N/A tproj[(int)this->connp] = 0; 1N/A * TCP Process "port closed" 1N/Afbt:ip:tcp_xmit_early_reset:entry 1N/A this->queuep = args[7]->tcps_g_q; 1N/A this->connp = (conn_t *)this->queuep->q_ptr; 1N/A this->tcpp = (tcp_t *)this->connp->conn_tcp; 1N/A self->zoneid = this->connp->conn_zoneid; 1N/A /* split addresses */ 1N/A this->ipha = (ipha_t *)args[1]->b_rptr; 1N/A this->fad15 = (this->ipha->ipha_src & 0xff000000) >> 24; 1N/A this->fad14 = (this->ipha->ipha_src & 0x00ff0000) >> 16; 1N/A this->fad13 = (this->ipha->ipha_src & 0x0000ff00) >> 8; 1N/A this->fad12 = (this->ipha->ipha_src & 0x000000ff); 1N/A this->lad15 = (this->ipha->ipha_dst & 0xff000000) >> 24; 1N/A this->lad14 = (this->ipha->ipha_dst & 0x00ff0000) >> 16; 1N/A this->lad13 = (this->ipha->ipha_dst & 0x0000ff00) >> 8; 1N/A this->lad12 = (this->ipha->ipha_dst & 0x000000ff); 1N/A /* stringify addresses */ 1N/A self->faddr = strjoin(lltostr(this->fad12), "."); 1N/A self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad13), ".")); 1N/A self->faddr = strjoin(self->faddr, strjoin(lltostr(this->fad14), ".")); 1N/A self->faddr = strjoin(self->faddr, lltostr(this->fad15 + 0)); 1N/A self->laddr = strjoin(lltostr(this->lad12), "."); 1N/A self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad13), ".")); 1N/A self->laddr = strjoin(self->laddr, strjoin(lltostr(this->lad14), ".")); 1N/A self->laddr = strjoin(self->laddr, lltostr(this->lad15 + 0)); 1N/A * TCP Fetch "port closed" ports 1N/Afbt:ip:tcp_xchg:entry 1N/A#if defined(_BIG_ENDIAN) 1N/A self->lport = (uint16_t)arg0; 1N/A self->fport = (uint16_t)arg1; 1N/A self->lport = BSWAP_16((uint16_t)arg0); 1N/A self->fport = BSWAP_16((uint16_t)arg1); 1N/A self->lport = BE16_TO_U16(arg0); 1N/A self->fport = BE16_TO_U16(arg1); 1N/A * TCP Print "port closed" 1N/Afbt:ip:tcp_xmit_early_reset:return 1N/A self->name = "<closed>"; 1N/A self->size = 54 * 2; /* should check trailers */ 1N/A OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/A OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/A OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/Afbt:ip:tcp_send_data:entry 1N/A self->conn_p = (conn_t *)args[0]->tcp_connp; 1N/Afbt:ip:tcp_send_data:entry 1N/A/tok[(int)self->conn_p]/ 1N/A self->size = msgdsize(args[2]) + 14; /* should check trailers */ 1N/A self->uid = tuid[(int)self->conn_p]; 1N/A self->laddr = tladdr[(int)self->conn_p]; 1N/A self->faddr = tfaddr[(int)self->conn_p]; 1N/A self->lport = tlport[(int)self->conn_p]; 1N/A self->fport = tfport[(int)self->conn_p]; 1N/A OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; 1N/A self->zoneid = self->conn_p->conn_zoneid; 1N/A /* follow inetd -> in.* transitions */ 1N/A self->name = pid && (tname[(int)self->conn_p] == "inetd") ? 1N/A execname : tname[(int)self->conn_p]; 1N/A self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? 1N/A pid : tpid[(int)self->conn_p]; 1N/A tname[(int)self->conn_p] = self->name; 1N/A tpid[(int)self->conn_p] = self->pid; 1N/Afbt:ip:tcp_rput_data:entry 1N/A self->conn_p = (conn_t *)arg0; 1N/A self->size = msgdsize(args[1]) + 14; /* should check trailers */ 1N/Afbt:ip:tcp_rput_data:entry 1N/A/tok[(int)self->conn_p]/ 1N/A self->uid = tuid[(int)self->conn_p]; 1N/A self->laddr = tladdr[(int)self->conn_p]; 1N/A self->faddr = tfaddr[(int)self->conn_p]; 1N/A self->lport = tlport[(int)self->conn_p]; 1N/A self->fport = tfport[(int)self->conn_p]; 1N/A OPT_proj ? self->proj = tproj[(int)self->conn_p] : 1; 1N/A self->zoneid = self->conn_p->conn_zoneid; 1N/A /* follow inetd -> in.* transitions */ 1N/A self->name = pid && (tname[(int)self->conn_p] == "inetd") ? 1N/A execname : tname[(int)self->conn_p]; 1N/A self->pid = pid && (tname[(int)self->conn_p] == "inetd") ? 1N/A pid : tpid[(int)self->conn_p]; 1N/A tname[(int)self->conn_p] = self->name; 1N/A tpid[(int)self->conn_p] = self->pid; 1N/A * TCP Complete printing outbound handshake 1N/Afbt:ip:tcp_connect:return 1N/A self->name = tname[(int)self->connp]; 1N/A self->pid = tpid[(int)self->connp]; 1N/A self->uid = tuid[(int)self->connp]; 1N/A self->zoneid = self->connp->conn_zoneid; 1N/A OPT_proj ? self->proj = tproj[(int)self->connp] : 1; 1N/A self->size = 54; /* should check trailers */ 1N/A /* this packet occured before connp was fully established */ 1N/A OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/A OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/A OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/A * TCP Complete printing inbound handshake 1N/Afbt:sockfs:sotpi_accept:return 1N/A self->name = tname[(int)self->connp]; 1N/A self->pid = tpid[(int)self->connp]; 1N/A self->uid = tuid[(int)self->connp]; 1N/A self->zoneid = self->connp->conn_zoneid; 1N/A OPT_proj ? self->proj = tproj[(int)self->connp] : 1; 1N/A self->size = 54 * 3; /* should check trailers */ 1N/A /* these packets occured before connp was fully established */ 1N/A OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/A OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/A OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/Afbt:ip:tcp_send_data:entry, 1N/Afbt:ip:tcp_rput_data:entry 1N/A OPT_def ? @out[self->uid, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/A OPT_zone ? @out[self->zoneid, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/A OPT_proj ? @out[self->proj, self->pid, self->laddr, self->lport, 1N/A self->faddr, self->fport, self->name] = sum(self->size) : 1; 1N/A * TCP Clear connect variables 1N/Afbt:sockfs:sotpi_accept:return, 1N/Afbt:ip:tcp_connect:return 1N/A * TCP Clear r/w variables 1N/Afbt:ip:tcp_send_data:entry, 1N/Afbt:ip:tcp_rput_data:entry 1N/A * TCP Systemwide Stats 1N/Amib:::tcpOutDataBytes { TCP_out += args[0]; } 1N/Amib:::tcpRetransBytes { TCP_out += args[0]; } 1N/Amib:::tcpInDataInorderBytes { TCP_in += args[0]; } 1N/Amib:::tcpInDataDupBytes { TCP_in += args[0]; } 1N/Amib:::tcpInDataUnorderBytes { TCP_in += args[0]; } 1N/A /* fetch 1 min load average */ 1N/A this->load1a = `hp_avenrun[0] / 65536; 1N/A this->load1b = ((`hp_avenrun[0] % 65536) * 100) / 65536; 1N/A /* convert TCP counters to Kbytes */ 1N/A OPT_clear ? printf("%s", CLEAR) : 1; 1N/A printf("%Y, load: %d.%02d, TCPin: %6d KB, TCPout: %6d KB\n\n", 1N/A walltimestamp, this->load1a, this->load1b, TCP_in, TCP_out); 1N/A OPT_def ? printf(" UID ") : 1; 1N/A OPT_proj ? printf("PROJ ") : 1; 1N/A OPT_zone ? printf("ZONE ") : 1; 1N/A printf("%6s %-15s %5s %-15s %5s %9s %s\n", 1N/A "PID", "LADDR", "LPORT", "RADDR", "RPORT", "SIZE", "NAME"); 1N/A printa("%4d %6d %-15s %5d %-15s %5d %@9d %s\n", @out); 1N/A * Cleanup for Ctrl-C