>
> - Perhaps a script that reports packets that have to be reassembled
> into larger ones or broken into smaller ones because of the MTU.
:
> - Packets received out of order.
This one may do the trick for most of the above two, though it can almost
definitely use better output-formatting.
#!/usr/sbin/dtrace -CFs
BEGIN
{
printf("ip_reass.d ready");
self->ip = (ipha_t *)NULL;
}
ip_rput_fragment:entry
{
ip = (ipha_t *)arg2;
self->ip = ip;
/* @id[ip->ipha_ident] = count(); */
self->ip = ip;
/*
* To view the packet src, dst and id:
ipsrc = (u_char *)&ip->ipha_src;
ipdst = (u_char *)&ip->ipha_dst;
printf(" %d.%d.%d.%d -> %d.%d.%d.%d (ident 0x%x) frag",
ipsrc[0], ipsrc[1], ipsrc[2], ipsrc[3],
ipdst[0], ipdst[1], ipdst[2], ipdst[3],
ip->ipha_ident);
*/
}
ip_reassemble:entry
{
ip = (ipha_t *)self->ip;
ill = (ill_t *)arg4;
ipsrc = (u_char *)&ip->ipha_src;
@jumble[ip->ipha_ident,
ipsrc[0], ipsrc[1], ipsrc[2], ipsrc[3],
(string)ill->ill_name] = count();
}
/*
ip_reassemble:return
{
printf(" 0x%x -> 0x%x (ident 0x%x) frags out of order; reassembly %s",
ip->ipha_src, ip->ipha_dst, ip->ipha_ident,
(arg1 == 1 ? "succeeded" :
(arg1 == 0 ? "incomplete": "failed")));
}
*/
END
{
trunc(@jumble, 30);
printf("\n number of packets with \n");
printa("\tID 0x%x from ip_src %d.%d.%d.%d on %s: [EMAIL PROTECTED]",
@jumble);
}
_______________________________________________
networking-discuss mailing list
[email protected]
