1Demonstrations of tcpv4connect.py, the Linux eBPF/bcc version.
2
3
4This example traces the kernel function performing active TCP IPv4 connections
5(eg, via a connect() syscall; accept() are passive connections). Some example
6output (IP addresses changed to protect the innocent):
7
8# ./tcpv4connect.py
9PID    COMM         SADDR            DADDR            DPORT
101479   telnet       127.0.0.1        127.0.0.1        23
111469   curl         10.201.219.236   54.245.105.25    80
121469   curl         10.201.219.236   54.67.101.145    80
13
14This output shows three connections, one from a "telnet" process and two from
15"curl". The output details shows the source address, destination address,
16and destination port. This traces attempted connections: these may have failed.
17
18The overhead of this tool should be negligible, since it is only tracing the
19kernel function performing a connect. It is not tracing every packet and then
20filtering.
21
22This is provided as a basic example of TCP tracing. See tools/tcpconnect for a
23more featured version of this example (a tool).
24