Actually Bredan already had one written: https://raw.githubusercontent.com/brendangregg/bpf-perf-tools-book/master/exercises/Ch10_Networking/udplife.bt With nslookup google.com, I get: Attaching 8 probes... PID COMM LADDR LPORT RADDR RPORT TX_B RX_B MS 3823 systemd-re 192.168.10.26 0 8.8.8.8 32927 39 110 27
I am not certain why RPORT is not 53 through. Sean On Mon, Oct 3, 2022 at 5:06 PM Sean Liu <sean.liu.2...@gmail.com> wrote: > Well what's hot nowadays in Linux is bpftrace which is built on top of > eBPF. > You probably can just 'apt install bpftrace' on your ubuntu18.04 which > *may* be a bit outdated. > Afterwards you can check out existing scripts, for example on my ubt 20.04: > sean@ubuntu:/usr/sbin$ ls *bt > bashreadline.bt capable.bt killsnoop.bt opensnoop.bt > statsnoop.bt tcpconnect.bt threadsnoop.bt > biolatency.bt cpuwalk.bt loads.bt pidpersec.bt swapin.bt > tcpdrop.bt vfscount.bt > biosnoop.bt dcsnoop.bt mdflush.bt runqlat.bt > syncsnoop.bt tcplife.bt vfsstat.bt > biostacks.bt execsnoop.bt naptime.bt runqlen.bt > syscount.bt tcpretrans.bt writeback.bt > bitesize.bt gethostlatency.bt oomkill.bt setuids.bt > tcpaccept.bt tcpsynbl.bt xfsdist.bt > > There are some resemblance between bpftrace and dtrace scripts so you > might be able to adapt what you need to bpftrace. > > Good luck, > > Sean > > On Mon, Oct 3, 2022 at 4:02 PM ch-and-dtrace.topicbox.com via > dtrace-discuss <dtrace-discuss@lists.dtrace.org> wrote: > >> Ok, I found perf (https://www.brendangregg.com/perf.html), and if I knew >> what I was doing, I think I'd be able to write a one-liner that did what I >> want. That's a big caveat, though. >> *DTrace <https://dtrace.topicbox.com/latest>* / dtrace-discuss / see >> discussions <https://dtrace.topicbox.com/groups/dtrace-discuss> + >> participants <https://dtrace.topicbox.com/groups/dtrace-discuss/members> >> + delivery options >> <https://dtrace.topicbox.com/groups/dtrace-discuss/subscription> >> Permalink >> <https://dtrace.topicbox.com/groups/dtrace-discuss/T345746b17158d294-M4ea6ca4c8a542ceb7d276016> >> ------------------------------------------ DTrace: dtrace-discuss Permalink: https://dtrace.topicbox.com/groups/dtrace-discuss/T345746b17158d294-M9792f99bb64b89e0b75a477d Delivery options: https://dtrace.topicbox.com/groups/dtrace-discuss/subscription
