---
name: "dtrace_ip"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/dtrace_ip"
---

# dtrace\_ip(4)

a DTrace provider for tracing events related to the IPv4 and IPv6 protocols

## NAME

**dtrace\_ip** – a DTrace provider for tracing events related to the IPv4 and IPv6 protocols

## SYNOPSIS

**ip:::receive**(*pktinfo\_t \**, *csinfo\_t \**, *ipinfo\_t \**, *ifinfo\_t \**, *ipv4info\_t \**, *ipv6info\_t \**);

**ip:::send**(*pktinfo\_t \**, *csinfo\_t \**, *ipinfo\_t \**, *ifinfo\_t \**, *ipv4info\_t \**, *ipv6info\_t \**);

## DESCRIPTION

The DTrace **ip** provider allows users to trace events in the [ip(4)](/ip/4.md) and [ip6(4)](/ip6/4.md) protocol implementations. The **ip:::send**() probe fires whenever the kernel prepares to transmit an IP packet, and the **ip:::receive**() probe fires whenever the kernel receives an IP packet. The arguments to these probes can be used to obtain detailed information about the IP headers of the corresponding packet, as well as the network interface on which the packet was sent or received. Unlike the [dtrace\_tcp(4)](/dtrace_tcp/4.md) and [dtrace\_udp(4)](/dtrace_udp/4.md) providers, **ip** provider probes are triggered by forwarded packets. That is, the probes will fire on packets that are not destined to the local host.

## ARGUMENTS

The *pktinfo\_t* argument is currently unimplemented and is included for compatibility with other implementations of this provider. Its fields are:

- *uintptr\_t* *pkt\_addr*

  Always set to 0.

The *csinfo\_t* argument is currently unimplemented and is included for compatibility with other implementations of this provider. Its fields are:

- *uintptr\_t* *cs\_addr*

  Always set to 0.

- *uint64\_t* *cs\_cid*

  A pointer to the *struct* *inpcb* for this packet, or NULL.

- *pid\_t* *cs\_pid*

  Always set to 0.

The *ipinfo\_t* argument contains IP fields common to both IPv4 and IPv6 packets. Its fields are:

- *uint8\_t* *ip\_ver*

  IP version of the packet, 4 for IPv4 packets and 6 for IPv6 packets.

- *uint32\_t* *ip\_plength*

  IP payload size. This does not include the size of the IP header or IPv6 option headers.

- *string* *ip\_saddr*

  IP source address.

- *string* *ip\_daddr*

  IP destination address.

The *ifinfo\_t* argument describes the outgoing and incoming interfaces for the packet in the **ip:::send**() and **ip:::receive**() probes respectively. Its fields are:

- *string* *if\_name*

  The interface name.

- *int8\_t* *if\_local*

  A boolean value indicating whether or not the interface is a loopback interface.

- *uintptr\_t* *if\_addr*

  A pointer to the *struct* *ifnet* which describes the interface. See the [ifnet(9)](/ifnet/9.md) manual page.

The *ipv4info\_t* argument contains the fields of the IP header for IPv4 packets. This argument is NULL for IPv6 packets. DTrace scripts should use the **ip\_ver**() field in the *ipinfo\_t* argument to determine whether to use this argument. Its fields are:

- *uint8\_t* *ipv4\_ver*

  IP version. This will always be 4 for IPv4 packets.

- *uint8\_t* *ipv4\_ihl*

  The IP header length, including options, in 32-bit words.

- *uint8\_t* *ipv4\_tos*

  IP type of service field.

- *uint16\_t* *ipv4\_length*

  The total packet length, including the header, in bytes.

- *uint16\_t* *ipv4\_ident*

  Identification field.

- *uint8\_t* *ipv4\_flags*

  The IP flags.

- *uint16\_t* *ipv4\_offset*

  The fragment offset of the packet.

- *uint8\_t* *ipv4\_ttl*

  Time to live field.

- *uint8\_t* *ipv4\_protocol*

  Next-level protocol ID.

- *string* *ipv4\_protostr*

  A string containing the name of the encapsulated protocol. The protocol strings are defined in the *protocol* array in */usr/lib/dtrace/ip.d*

- *uint16\_t* *ipv4\_checksum*

  The IP checksum.

- *ipaddr\_t* *ipv4\_src*

  IPv4 source address.

- *ipaddr\_t* *ipv4\_dst*

  IPv4 destination address.

- *string* *ipv4\_saddr*

  A string representation of the source address.

- *string* *ipv4\_daddr*

  A string representation of the destination address.

- *ipha\_t* *\*ipv4\_hdr*

  A pointer to the raw IPv4 header.

The *ipv6info\_t* argument contains the fields of the IP header for IPv6 packets. Its fields are not set for IPv4 packets; as with the *ipv4info\_t* argument, the **ip\_ver**() field should be used to determine whether this argument is valid. Its fields are:

- *uint8\_t* *ipv6\_ver*

  IP version. This will always be 6 for IPv6 packets.

- *uint8\_t* *ipv6\_tclass*

  The traffic class, used to set the differentiated services codepoint and extended congestion notification flags.

- *uint32\_t* *ipv6\_flow*

  The flow label of the packet.

- *uint16\_t* *ipv6\_plen*

  The IP payload size, including extension headers, in bytes.

- *uint8\_t* *ipv6\_nexthdr*

  An identifier for the type of the next header.

- *string* *ipv6\_nextstr*

  A string representation of the type of the next header.

- *uint8\_t* *ipv6\_hlim*

  The hop limit.

- *ip6\_addr\_t* *\*ipv6\_src*

  IPv6 source address.

- *ip6\_addr\_t* *\*ipv6\_dst*

  IPv6 destination address.

- *string* *ipv6\_saddr*

  A string representation of the source address.

- *string* *ipv6\_daddr*

  A string representation of the destination address.

- *struct* *ip6\_hdr* *\*ipv6\_hdr*

  A pointer to the raw IPv6 header.

## FILES

- */usr/lib/dtrace/ip.d*

  DTrace type and translator definitions for the **ip** provider.

## EXAMPLES

The following script counts received packets by remote host address.

```
ip:::receive
{
        @num[args[2]->ip_saddr] = count();
}
```

This script will print some details of each IP packet as it is sent or received by the kernel:

```
#pragma D option quiet
#pragma D option switchrate=10Hz
dtrace:::BEGIN
{
        printf(" %10s %30s    %-30s %8s %6s\n", "DELTA(us)", "SOURCE",
            "DEST", "INT", "BYTES");
        last = timestamp;
}
ip:::send
{
        this->elapsed = (timestamp - last) / 1000;
        printf(" %10d %30s -> %-30s %8s %6d\n", this->elapsed,
            args[2]->ip_saddr, args[2]->ip_daddr, args[3]->if_name,
            args[2]->ip_plength);
        last = timestamp;
}
ip:::receive
{
        this->elapsed = (timestamp - last) / 1000;
        printf(" %10d %30s <- %-30s %8s %6d\n", this->elapsed,
            args[2]->ip_daddr, args[2]->ip_saddr, args[3]->if_name,
            args[2]->ip_plength);
        last = timestamp;
}
```

## COMPATIBILITY

This provider is compatible with the **ip** providers found in Solaris and Darwin.

## SEE ALSO

[dtrace(1)](/dtrace/1.md), [dtrace\_mib(4)](/dtrace_mib/4.md), [dtrace\_tcp(4)](/dtrace_tcp/4.md), [dtrace\_udp(4)](/dtrace_udp/4.md), [ip(4)](/ip/4.md), [ip6(4)](/ip6/4.md), [ifnet(9)](/ifnet/9.md), [SDT(9)](/SDT/9.md)

## HISTORY

The **ip** provider first appeared in FreeBSD 10.0.

## AUTHORS

This manual page was written by Mark Johnston ⟨*markj@FreeBSD.org*⟩.