1*387f9dfdSAndroid Build Coastguard WorkerDemonstrations of tcpv4connect.py, the Linux eBPF/bcc version. 2*387f9dfdSAndroid Build Coastguard Worker 3*387f9dfdSAndroid Build Coastguard Worker 4*387f9dfdSAndroid Build Coastguard WorkerThis example traces the kernel function performing active TCP IPv4 connections 5*387f9dfdSAndroid Build Coastguard Worker(eg, via a connect() syscall; accept() are passive connections). Some example 6*387f9dfdSAndroid Build Coastguard Workeroutput (IP addresses changed to protect the innocent): 7*387f9dfdSAndroid Build Coastguard Worker 8*387f9dfdSAndroid Build Coastguard Worker# ./tcpv4connect.py 9*387f9dfdSAndroid Build Coastguard WorkerPID COMM SADDR DADDR DPORT 10*387f9dfdSAndroid Build Coastguard Worker1479 telnet 127.0.0.1 127.0.0.1 23 11*387f9dfdSAndroid Build Coastguard Worker1469 curl 10.201.219.236 54.245.105.25 80 12*387f9dfdSAndroid Build Coastguard Worker1469 curl 10.201.219.236 54.67.101.145 80 13*387f9dfdSAndroid Build Coastguard Worker 14*387f9dfdSAndroid Build Coastguard WorkerThis output shows three connections, one from a "telnet" process and two from 15*387f9dfdSAndroid Build Coastguard Worker"curl". The output details shows the source address, destination address, 16*387f9dfdSAndroid Build Coastguard Workerand destination port. This traces attempted connections: these may have failed. 17*387f9dfdSAndroid Build Coastguard Worker 18*387f9dfdSAndroid Build Coastguard WorkerThe overhead of this tool should be negligible, since it is only tracing the 19*387f9dfdSAndroid Build Coastguard Workerkernel function performing a connect. It is not tracing every packet and then 20*387f9dfdSAndroid Build Coastguard Workerfiltering. 21*387f9dfdSAndroid Build Coastguard Worker 22*387f9dfdSAndroid Build Coastguard WorkerThis is provided as a basic example of TCP tracing. See tools/tcpconnect for a 23*387f9dfdSAndroid Build Coastguard Workermore featured version of this example (a tool). 24