undump.bt.bt8
Catch unix domain socket packages. uses bpftrace/ebpf.
Usage
undump.bt
Overview
undump.bt tracked reception of UNIX domain sockets.
This program is also a basic example of bpftrace and kprobes.
Since this uses BPF, only the root user can use this tool.
Requirements
CONFIG_BPF and bpftrace.
Examples
- Trace reception of UNIX domain sockets:
-
#
undump.bt
Fields
- TIME
-
A timestamp on the output, in "HH:MM:SS" format.
- COMM
-
The process COMM.
- PID
-
The process ID.
- SIZE
-
The size of the received packet, in bytes.
- DATA
-
Display received packets in hex or string.
Overhead
The overhead of this program mainly comes from the data packets received by the terminal output.
Source
This is from bpftrace.
-
https://github.com/iovisor/bpftrace
Also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool.
This is a bpftrace version of the bcc examples/tracing of the same name. The bcc tool may provide more options and customizations.
-
https://github.com/iovisor/bcc
OS
Linux
Stability
Unstable - in development.