On Wed, Oct 23, 2024 at 8:59 PM Menglong Dong <[email protected]> wrote: > > On Wed, Oct 23, 2024 at 8:33 PM Yafang Shao <[email protected]> wrote: > > > > We previously hooked the tcp_drop_reason() function using BPF to monitor > > TCP drop reasons. However, after upgrading our compiler from GCC 9 to GCC > > 11, tcp_drop_reason() is now inlined, preventing us from hooking into it. > > To address this, it would be beneficial to introduce a dedicated tracepoint > > for monitoring. > > Hello, > > Can the existing tracepoint kfree_skb do this work? AFAIK, you > can attach you BPF to the kfree_skb tracepoint and do some filter > according to the "protocol" field, or the information "sk" field. And > this works fine in my tool. > > I hope I'm not missing something :/ > > BTW, I do such filter in probe_parse_skb_sk() in > https://github.com/OpenCloudOS/nettrace/blob/master/shared/bpf/skb_parse.h
We prefer not to hook the kfree_skb tracepoint, as we want to avoid the overhead of parsing extensive information from @skb. Since we now have a function that can be easily hooked, why not hook it directly? -- Regards Yafang
