系统相关
首页 > 系统相关> > Linux tracepoint分析

Linux tracepoint分析

作者:互联网

tracepoint介绍

Brendan Gregg大神博客对tracepoint做了说明,同时看到taobao技术博客对文章进行了翻译,学习整理如下。

测试系统版本

$ uname -r
5.4.0-72-generic

利用bcc的tplist工具查看当前版本支持的tracepoint点:

$ sudo /usr/share/bcc/tools/tplist -v 'tcp:*'
tcp:tcp_retransmit_skb
   const void * skbaddr;
   const void * skaddr;
   int state;
   __u16 sport;
   __u16 dport;
   __u8 saddr[4];
   __u8 daddr[4];
   __u8 saddr_v6[16];
   __u8 daddr_v6[16];
tcp:tcp_send_reset
   const void * skbaddr;
   const void * skaddr;
   int state;
   __u16 sport;
   __u16 dport;
   __u8 saddr[4];
   __u8 daddr[4];
   __u8 saddr_v6[16];
   __u8 daddr_v6[16];
tcp:tcp_receive_reset
   const void * skaddr;
   __u16 sport;
   __u16 dport;
   __u8 saddr[4];
   __u8 daddr[4];
   __u8 saddr_v6[16];
   __u8 daddr_v6[16];
   __u64 sock_cookie;
tcp:tcp_destroy_sock
   const void * skaddr;
   __u16 sport;
   __u16 dport;
   __u8 saddr[4];
   __u8 daddr[4];
   __u8 saddr_v6[16];
   __u8 daddr_v6[16];
   __u64 sock_cookie;
tcp:tcp_rcv_space_adjust
   const void * skaddr;
   __u16 sport;
   __u16 dport;
   __u8 saddr[4];
   __u8 daddr[4];
   __u8 saddr_v6[16];
   __u8 daddr_v6[16];
   __u64 sock_cookie;
tcp:tcp_retransmit_synack
   const void * skaddr;
   const void * req;
   __u16 sport;
   __u16 dport;
   __u8 saddr[4];
   __u8 daddr[4];
   __u8 saddr_v6[16];
   __u8 daddr_v6[16];
tcp:tcp_probe
   __u8 saddr[sizeof(struct sockaddr_in6)];
   __u8 daddr[sizeof(struct sockaddr_in6)];
   __u16 sport;
   __u16 dport;
   __u32 mark;
   __u16 data_len;
   __u32 snd_nxt;
   __u32 snd_una;
   __u32 snd_cwnd;
   __u32 ssthresh;
   __u32 snd_wnd;
   __u32 srtt;
   __u32 rcv_wnd;
   __u64 sock_cookie;

$ sudo /usr/share/bcc/tools/tplist -v 'sock:*'
sock:sock_rcvqueue_full
   int rmem_alloc;
   unsigned int truesize;
   int sk_rcvbuf;
sock:sock_exceed_buf_limit
   char name[32];
   long * sysctl_mem;
   long allocated;
   int sysctl_rmem;
   int rmem_alloc;
   int sysctl_wmem;
   int wmem_alloc;
   int wmem_queued;
   int kind;
sock:inet_sock_set_state
   const void * skaddr;
   int oldstate;
   int newstate;
   __u16 sport;
   __u16 dport;
   __u16 family;
   __u8 protocol;
   __u8 saddr[4];
   __u8 daddr[4];
   __u8 saddr_v6[16];
   __u8 daddr_v6[16];

对上述tracepoint的说明如下:

使用示例

编写ply程序,利用sock:inet_sock_set_state实现连接状态变化跟踪:

sudo ply 'tracepoint:sock/inet_sock_set_state { printf("saddr: %v sport: %v -> daddr: %v dport: %v, old_state: %v, new_state: %v\n", data->saddr, data->sport, data->daddr, data->dport, data->oldstate, data->newstate);}'

输出如下:

$  sudo ply 'tracepoint:sock/inet_sock_set_state { printf("saddr: %v sport: %v -> daddr: %v dport: %v, old_state: %v, new_state: %v\n", data->saddr, data->sport, data->daddr, data->dport, data->oldstate, data->newstate);}'
ply: active
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 47600 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 2, new_state: 1
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [13, 225, 93, 17] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 48316 -> daddr: [13, 225, 93, 17] dport: 443, old_state: 2, new_state: 1
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [99, 84, 203, 13] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 42292 -> daddr: [99, 84, 203, 13] dport: 443, old_state: 2, new_state: 1
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [104, 193, 90, 87] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 47610 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 2, new_state: 1
saddr: [192, 168, 136, 163] sport: 47612 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 2, new_state: 1
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 47606 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 2, new_state: 1
saddr: [192, 168, 136, 163] sport: 0 -> daddr: [104, 193, 90, 87] dport: 443, old_state: 7, new_state: 2
saddr: [192, 168, 136, 163] sport: 44286 -> daddr: [104, 193, 90, 87] dport: 443, old_state: 2, new_state: 1
saddr: [192, 168, 136, 163] sport: 47618 -> daddr: [104, 193, 88, 77] dport: 443, old_state: 2, new_state: 1
saddr: [192, 168, 136, 163] sport: 44292 -> daddr: [104, 193, 90, 87] dport: 443, old_state: 2, new_state: 1

其中关于连接状态的枚举值,可以参考Linux内核源码:

# /include/net/tcp_states.h
enum {
   TCP_ESTABLISHED = 1,
   TCP_SYN_SENT,
   TCP_SYN_RECV,
   TCP_FIN_WAIT1,
   TCP_FIN_WAIT2,
   TCP_TIME_WAIT,
   TCP_CLOSE,
   TCP_CLOSE_WAIT,
   TCP_LAST_ACK,
   TCP_LISTEN,
   TCP_CLOSING,	/* Now a valid state */
   TCP_NEW_SYN_RECV,

   TCP_MAX_STATES	/* Leave at the end! */
};

参考

http://www.brendangregg.com/blog/2018-03-22/tcp-tracepoints.html
https://kernel.taobao.org/2019/10/TCP-Tracepoints/

标签:分析,__,Linux,tcp,daddr,state,saddr,sport,tracepoint
来源: https://www.cnblogs.com/init0ne/p/14678770.html