14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync#!/usr/sbin/dtrace -s
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/*
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * tcptop: display top TCP network packets by process.
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * Written using DTrace tcp Provider.
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync *
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * Usage: dtrace -s tcptop.d [count] [interval]
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync *
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * This analyses TCP network packets and prints the responsible PID plus
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * standard details such as IP address and port. This captures traffic
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * of newly created TCP connections that were established while this program
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * was running along with traffic from existing connections. It can help
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * identify which processes is causing TCP traffic.
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync *
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * CDDL HEADER START
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync *
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * The contents of this file are subject to the terms of the
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * Common Development and Distribution License (the "License").
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * You may not use this file except in compliance with the License.
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync *
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * or http://www.opensolaris.org/os/licensing.
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * See the License for the specific language governing permissions
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * and limitations under the License.
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync *
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * When distributing Covered Code, include this CDDL HEADER in each
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * If applicable, add the following below this CDDL HEADER, with the
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * fields enclosed by brackets "[]" replaced with your own identifying
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * information: Portions Copyright [yyyy] [name of copyright owner]
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync *
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * CDDL HEADER END
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/*
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync *
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * Portions Copyright 2010 Brendan Gregg
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync#pragma D option quiet
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync#pragma D option defaultargs
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync#pragma D option switchrate=10hz
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/*
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * Print header
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsyncdtrace:::BEGIN
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync{
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync /* starting values */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync counts = $1 ? $1 : 10;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync secs = $2 ? $2 : 5;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync TCP_out = 0;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync TCP_in = 0;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync printf("Sampling... Please wait.\n");
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync}
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsynctcp:::send
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/ args[1]->cs_pid != -1 /
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync{
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync @out[args[1]->cs_zoneid, args[1]->cs_pid, args[2]->ip_saddr,
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync args[4]->tcp_sport, args[2]->ip_daddr, args[4]->tcp_dport] =
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync sum(args[2]->ip_plength - args[4]->tcp_offset);
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync}
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsynctcp:::receive
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/ args[1]->cs_pid != -1 /
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync{
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync @out[args[1]->cs_zoneid, args[1]->cs_pid, args[2]->ip_daddr,
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync args[4]->tcp_dport, args[2]->ip_saddr, args[4]->tcp_sport] =
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync sum(args[2]->ip_plength - args[4]->tcp_offset);
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync}
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/*
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * TCP Systemwide Stats
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsyncmib:::tcpOutDataBytes { TCP_out += args[0]; }
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsyncmib:::tcpRetransBytes { TCP_out += args[0]; }
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsyncmib:::tcpInDataInorderBytes { TCP_in += args[0]; }
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsyncmib:::tcpInDataDupBytes { TCP_in += args[0]; }
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsyncmib:::tcpInDataUnorderBytes { TCP_in += args[0]; }
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsyncprofile:::tick-1sec
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/secs != 0/
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync{
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync secs--;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync}
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/*
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * Print Report
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsyncprofile:::tick-1sec
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/secs == 0/
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync{
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync /* fetch 1 min load average */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync this->load1a = `hp_avenrun[0] / 65536;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync this->load1b = ((`hp_avenrun[0] % 65536) * 100) / 65536;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync /* convert TCP counters to Kb */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync TCP_out /= 1024;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync TCP_in /= 1024;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync /* print status */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync printf("%Y, load: %d.%02d, TCPin: %6d Kb, TCPout: %6d Kb\n\n",
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync walltimestamp, this->load1a, this->load1b, TCP_in, TCP_out);
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync /* print headers */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync printf("%6s %6s %-15s %5s %-15s %5s %9s\n",
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync "ZONE", "PID", "LADDR", "LPORT", "RADDR", "RPORT", "SIZE");
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync /* print data */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync printa("%6d %6d %-15s %5d %-15s %5d %@9d\n", @out);
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync printf("\n");
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync /* clear data */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync trunc(@out);
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync TCP_in = 0;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync TCP_out = 0;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync secs = 5;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync counts--;
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync}
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/*
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * End of program
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsyncprofile:::tick-1sec
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/counts == 0/
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync{
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync exit(0);
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync}
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync/*
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync * Cleanup for Ctrl-C
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync */
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsyncdtrace:::END
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync{
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync trunc(@out);
14ea49401f3c8c61422aefbda43809e275f60c6cvboxsync}