bpftrace MCP Server

#!/usr/bin/env bpftrace /* * tcpconnect.bt Trace TCP connect()s. * For Linux, uses bpftrace and eBPF. * * USAGE: tcpconnect.bt * * This is a bpftrace version of the bcc tool of the same name. * It is limited to ipv4 addresses. * * All connection attempts are traced, even if they ultimately fail. * * This uses dynamic tracing of kernel functions, and will need to be updated * to match kernel changes. * * Copyright (c) 2018 Dale Hamel. * Licensed under the Apache License, Version 2.0 (the "License") * * 23-Nov-2018 Dale Hamel created this. */ #ifndef BPFTRACE_HAVE_BTF #include <linux/socket.h> #include <net/sock.h> #else #include <sys/socket.h> #endif BEGIN { printf("Tracing tcp connections. Hit Ctrl-C to end.\n"); printf("%-8s %-8s %-16s ", "TIME", "PID", "COMM"); printf("%-39s %-6s %-39s %-6s\n", "SADDR", "SPORT", "DADDR", "DPORT"); } kprobe:tcp_connect { $sk = ((struct sock *) arg0); $inet_family = $sk->__sk_common.skc_family; if ($inet_family == AF_INET || $inet_family == AF_INET6) { if ($inet_family == AF_INET) { $daddr = ntop($sk->__sk_common.skc_daddr); $saddr = ntop($sk->__sk_common.skc_rcv_saddr); } else { $daddr = ntop($sk->__sk_common.skc_v6_daddr.in6_u.u6_addr8); $saddr = ntop($sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr8); } $lport = $sk->__sk_common.skc_num; $dport = $sk->__sk_common.skc_dport; // Destination port is big endian, it must be flipped $dport = bswap($dport); time("%H:%M:%S "); printf("%-8d %-16s ", pid, comm); printf("%-39s %-6d %-39s %-6d\n", $saddr, $lport, $daddr, $dport); } }