SystemTap 监控tcp的连接

这个例子很简单，却很有用，所以贴出来。

#! /usr/bin/env stap

probe begin {
  printf("%6s %16s %6s %6s %16s\n",
         "UID", "CMD", "PID", "PORT", "IP_SOURCE")
}

probe kernel.function("tcp_accept").return?,
      kernel.function("inet_csk_accept").return? {
  sock = $return
  if (sock != 0)
    printf("%6d %16s %6d %6d %16s\n", uid(), execname(), pid(),
           inet_get_local_port(sock), inet_get_ip_source(sock))
}

inet_get_local_port(sock), inet_get_ip_source(sock)
是tapset里的两个函数，分别返回sock的本地端口和对端ip.