sofamily.bt

#!/usr/local/bin/bpftrace
/*
 * sofamily - Count address families for new sockets by process.
 *
 * See BPF Performance Tools, Chapter 10, for an explanation of this tool.
 *
 * Copyright (c) 2019 Brendan Gregg.
 * Licensed under the Apache License, Version 2.0 (the "License").
 * This was originally created for the BPF Performance Tools book
 * published by Addison Wesley. ISBN-13: 9780136554820
 * When copying or porting, include this comment.
 *
 * 10-Apr-2019  Brendan Gregg   Created this.
 */

#include <linux/socket.h>

BEGIN
{
	printf("Tracing socket connect/accepts. Ctrl-C to end.\n");
	// from linux/socket.h:
	@fam2str[AF_UNSPEC] = "AF_UNSPEC";
	@fam2str[AF_UNIX] = "AF_UNIX";
	@fam2str[AF_INET] = "AF_INET";
	@fam2str[AF_INET6] = "AF_INET6";
}

tracepoint:syscalls:sys_enter_connect
{
	@connect[comm, args->uservaddr->sa_family,
	    @fam2str[args->uservaddr->sa_family]] = count();
}

tracepoint:syscalls:sys_enter_accept,
tracepoint:syscalls:sys_enter_accept4
{
	@sockaddr[tid] = args->upeer_sockaddr;
}

tracepoint:syscalls:sys_exit_accept,
tracepoint:syscalls:sys_exit_accept4
/@sockaddr[tid]/
{
	if (args->ret > 0) {
		$sa = (struct sockaddr *)@sockaddr[tid];
		@accept[comm, $sa->sa_family, @fam2str[$sa->sa_family]] =
		    count();
	}
	delete(@sockaddr[tid]);
}

END
{
	clear(@sockaddr); clear(@fam2str);
}