---
name: "ksnoop-bpfcc"
section: "8"
platform: "linux"
package: "bpfcc-tools"
version: "0.31.0+ds-7"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/ksnoop-bpfcc"
---

# ksnoop-bpfcc(8)

tool for tracing kernel function entry/return showing arguments/return values

## NAME

KSNOOP - tool for tracing kernel function entry/return showing arguments/return values

## SYNOPSIS

**ksnoop** \[*OPTIONS*\] { *COMMAND*  *FUNC* \| **help** }

*OPTIONS* := { { **-V** \| **--version** } \| { **-h** \| **--help** } \| { \[**-P** \| **--pages**\] nr\_pages} \| { \[**-p** \| **--pid**\] pid} \| \[{ **-s** \| **--stack** }\] \| \[{ **-d** \| **--debug** }\] }

*COMMAND* := { **trace** \| **info** }

*FUNC* := { **name** \| **name**(**arg**\[,\*\*arg\]) }

## DESCRIPTION

*ksnoop* allows for inspection of arguments and return values associated with function entry/return.

- **ksnoop info *FUNC***

  Show function description, arguments and return value types.

- **ksnoop trace *FUNC* \[*FUNC*\]**

  Trace function entry and return, showing arguments and return values.  A function name can simply be specified, or a function name along with named arguments, return values. **return** is used to specify the return value.

*ksnoop* requires the kernel to provide BTF for itself, and if tracing of module data is required, module BTF must be present also. Check /sys/kernel/btf to see if BTF is present.

**ksnoop** requires *CAP\_BPF* and *CAP\_TRACING* capabilities.

## OPTIONS

- **-h, --help**

  Show help information

- **-V, --version**

  Show version.

- **-d, --debug**

  Show debug output.

- **-p, --pid**

  Filter events by pid.

- **-P, --pages**

  Specify number of pages used per-CPU for perf event collection.  Default is 8.

- **-s, --stack**

  Specified set of functions are traced if and only if they are encountered in the order specified.

## EXAMPLES

**# ksnoop info ip\_send\_skb**

```
int  ip_send_skb(struct net  * net, struct sk_buff  * skb);
```

Show function description.

**# ksnoop trace ip\_send\_skb**

```
          TIME  CPU      PID FUNCTION/ARGS
78101668506811    1     2813 ip_send_skb(
                                 net = *(0xffffffffb5959840)
                                  (struct net){
                                   .passive = (refcount_t){
                                    .refs = (atomic_t){
                                     .counter = (int)0x2,
                                    },
                                   },
                                   .dev_base_seq = (unsigned int)0x18,
                                   .ifindex = (int)0xf,
                                   .list = (struct list_head){
                                    .next = (struct list_head *)0xffff9895440dc120,
                                    .prev = (struct list_head *)0xffffffffb595a8d0,
                                   },
                                 ...
79561322965250    1     2813 ip_send_skb(
                                 return =
                                  (int)0x0
                             );
```

Show entry/return for ip\_send\_skb() with arguments, return values.

**# ksnoop trace "ip\_send\_skb(skb)"**

```
         TIME  CPU      PID FUNCTION/ARGS
78142420834537    1     2813 ip_send_skb(
                                 skb = *(0xffff989750797c00)
                                  (struct sk_buff){
                                   (union){
                                    .sk = (struct sock *)0xffff98966ce19200,
                                    .ip_defrag_offset = (int)0x6ce19200,
                                   },
                                   (union){
                                    (struct){
                                     ._skb_refdst = (long unsigned int)0xffff98981dde2d80,
                                     .destructor = (void (*)(struct sk_buff *))0xffffffffb3e1beb0,
                                    },
                                ...
```

Show entry argument **skb**.

**# ksnoop trace "ip\_send\_skb(return)"**

```
         TIME  CPU      PID FUNCTION/ARGS
78178228354796    1     2813 ip_send_skb(
                                 return =
                                  (int)0x0
                             );
```

Show return value from ip\_send\_skb().

**# ksnoop trace "ip\_send\_skb(skb-\>sk)"**

```
          TIME  CPU      PID FUNCTION/ARGS
78207649138829    2     2813 ip_send_skb(
                                 skb->sk = *(0xffff98966ce19200)
                                  (struct sock){
                                   .__sk_common = (struct sock_common){
                                    (union){
                                     .skc_addrpair = (__addrpair)0x1701a8c017d38f8d,
                                     (struct){
                                      .skc_daddr = (__be32)0x17d38f8d,
                                      .skc_rcv_saddr = (__be32)0x1701a8c0,
                                     },
                                    },
                                  ...
```

Trace member information associated with argument.  Only one level of membership is supported.

**# ksnoop -p 2813 "ip\_rcv(dev)"**

```
          TIME  CPU      PID FUNCTION/ARGS
78254803164920    1     2813 ip_rcv(
                                 dev = *(0xffff9895414cb000)
                                  (struct net_device){
                                   .name = (char[16])[
                                    'l',
                                    'o',
                                   ],
                                   .name_node = (struct netdev_name_node *)0xffff989541515ec0,
                                   .state = (long unsigned int)0x3,
                                 ...
```

Trace **dev** argument of **ip\_rcv()**.  Specify process id 2813 for events for that process only.

**# ksnoop -s tcp\_sendmsg \_\_tcp\_transmit\_skb  ip\_output**

```
         TIME  CPU      PID FUNCTION/ARGS
71827770952903    1     4777 __tcp_transmit_skb(
                                 sk = *(0xffff9852460a2300)
                                  (struct sock){
                                   .__sk_common = (struct sock_common){
                                    (union){
                                     .skc_addrpair = (__addrpair)0x61b2af0a35cbfe0a,
```

Trace entry/return of tcp\_sendmsg, \_\_tcp\_transmit\_skb and ip\_output when tcp\_sendmsg leads to a call to \_\_tcp\_transmit\_skb and that in turn leads to a call to ip\_output; i.e. with a call graph matching the order specified.  The order does not have to be direct calls, i.e. function A can call another function that calls function B.

**# ksnoop "ip\_send\_skb(skb-\>len \> 100, skb)"**

```
          TIME  CPU      PID FUNCTION/ARGS
39267395709745    1     2955 ip_send_skb(
                                 skb->len =
                                  (unsigned int)0x89,
                                 skb = *(0xffff89c8be81e500)
                                  (struct sk_buff){
                                   (union){
                                    .sk = (struct sock *)0xffff89c6c59e5580,
                                    .ip_defrag_offset = (int)0xc59e5580,
                                   },
```

Trace ip\_send\_skb() skbs which have len \> 100.

## SEE ALSO

[**bpf**(2)](/bpf/2.md),