forked from iovisor/bcc
-
Notifications
You must be signed in to change notification settings - Fork 0
/
tcpconnect.8
181 lines (173 loc) · 5.37 KB
/
tcpconnect.8
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
.TH tcpconnect 8 "2020-02-20" "USER COMMANDS"
.SH NAME
tcpconnect \- Trace TCP active connections (connect()). Uses Linux eBPF/bcc.
.SH SYNOPSIS
.B tcpconnect [\-h] [\-c] [\-t] [\-p PID] [-P PORT] [-u UID] [-U] [\-\-cgroupmap MAPPATH] [\-\-mntnsmap MAPPATH] [\-d]
.SH DESCRIPTION
This tool traces active TCP connections (eg, via a connect() syscall;
accept() are passive connections). This can be useful for general
troubleshooting to see what connections are initiated by the local server.
All connection attempts are traced, even if they ultimately fail.
This works by tracing the kernel tcp_v4_connect() and tcp_v6_connect() functions
using dynamic tracing, and will need updating to match any changes to these
functions.
When provided with the \-d or \-\-dns option, this tool will also correlate
connect calls with the most recent DNS query that matches the IP connected.
This feature works by tracing the kernel udp_recvmsg() function to collect DNS
responses.
Since this uses BPF, only the root user can use this tool.
.SH REQUIREMENTS
CONFIG_BPF and bcc.
If using the \-d or \-\-dns option, you must have the
dnslib and cachetools python packages installed. You can install them with pip3 or with
apt on Ubuntu 18.04+ using the python3\-dnslib and python3\-cachetools packages.
.SH OPTIONS
.TP
\-h
Print usage message.
.TP
\-t
Include a timestamp column.
.TP
\-c
Count connects per src ip and dest ip/port.
.TP
\-p PID
Trace this process ID only (filtered in-kernel).
.TP
\-P PORT
Comma-separated list of destination ports to trace (filtered in-kernel).
.TP
\-U
Include a UID column.
.TP
\-u UID
Trace this UID only (filtered in-kernel).
.TP
\-\-cgroupmap MAPPATH
Trace cgroups in this BPF map only (filtered in-kernel).
.TP
\--mntnsmap MAPPATH
Trace mount namespaces in this BPF map only (filtered in-kernel).
.TP
\-d
Shows the most recent DNS query for the IP address in the connect call.
This is likely related to the TCP connection details in the other columns, but is not guaranteed.
This
feature works by tracing the udp_recvmsg kernel function and tracking DNS
responses received by the server. It only supports UDP DNS packets up to 512 bytes
in length. The python code keeps a cache of 10k DNS responses in memory
for up 24 hours.
If the time difference in milliseconds
between when the system received a DNS response and when a
connect syscall was traced using an IP in that DNS response is greater than 100ms,
this tool will report this delta after the query.
These deltas should be relatively short for most applications. A
long delay between the response and connect could be either anomalous activity
or indicate a misattribution between the DNS name requested and the IP that
the connect syscall is using.
The \-d option may not be used with the count feature (option \-c)
.SH EXAMPLES
.TP
Trace all active TCP connections:
#
.B tcpconnect
.TP
Trace all TCP connects, and include timestamps:
#
.B tcpconnect \-t
.TP
Trace all TCP connects, and include most recent matching DNS query for each connected IP
#
.B tcpconnect \-d
.TP
Trace PID 181 only:
#
.B tcpconnect \-p 181
.TP
Trace ports 80 and 81 only:
#
.B tcpconnect \-P 80,81
.TP
Trace all TCP connects, and include UID:
#
.B tcpconnect \-U
.TP
Trace UID 1000 only:
#
.B tcpconnect \-u 1000
.TP
Count connects per src ip and dest ip/port:
#
.B tcpconnect \-c
.TP
Trace a set of cgroups only (see special_filtering.md from bcc sources for more details):
#
.B tcpconnect \-\-cgroupmap /sys/fs/bpf/test01
.TP
Trace a set of mount namespaces only (see special_filtering.md from bcc sources for more details):
#
.B tcpconnect \-\-mntnsmap /sys/fs/bpf/mnt_ns_set
.SH FIELDS
.TP
TIME(s)
Time of the call, in seconds.
.TP
UID
User ID
.TP
PID
Process ID
.TP
COMM
Process name
.TP
IP
IP address family (4 or 6)
.TP
SADDR
Source IP address.
.TP
DADDR
Destination IP address.
.TP
DPORT
Destination port
.TP
CONNECTS
Accumulated active connections since start.
.TP
QUERY
Shows the most recent DNS query for the IP address in the connect call.
This is likely related to the TCP connection details in the other columns, but is not guaranteed.
.SH OVERHEAD
This traces the kernel tcp_v[46]_connect functions and prints output for each
event. As the rate of this is generally expected to be low (< 1000/s), the
overhead is also expected to be negligible. If you have an application that
is calling a high rate of connect()s, such as a proxy server, then test and
understand this overhead before use.
If you are using the \-d option to track DNS requests, this tool will trace the
udp_recvmsg function and generate an event for any packets from UDP port 53.
This event contains up to 512 bytes of the UDP packet payload.
Typical applications do not extensively use UDP, so the performance overhead of
tracing udp_recvmsg is
expected to be negligible, However, if you have an application that receives
many UDP packets, then you should test and understand the overhead of tracing
every received UDP message. Furthermore, performance overhead of running
this tool on a DNS server is expected to be higher than average because all
DNS response packets will be copied to userspace.
.SH SOURCE
This is from bcc.
.IP
https://github.com/iovisor/bcc
.PP
Also look in the bcc distribution for a companion _examples.txt file containing
example usage, output, and commentary for this tool.
.SH OS
Linux
.SH STABILITY
Unstable - in development.
.SH AUTHOR
Brendan Gregg
.SH SEE ALSO
tcptracer(8), tcpaccept(8), funccount(8), tcpdump(8)