117 lines
4.4 KiB
Plaintext
117 lines
4.4 KiB
Plaintext
Demonstrations of bindsnoop, the Linux eBPF/bcc version.
|
|
|
|
This tool traces the kernel function performing socket binding and
|
|
print socket options set before the system call invocation that might
|
|
impact bind behavior and bound interface:
|
|
SOL_IP IP_FREEBIND F....
|
|
SOL_IP IP_TRANSPARENT .T...
|
|
SOL_IP IP_BIND_ADDRESS_NO_PORT ..N..
|
|
SOL_SOCKET SO_REUSEADDR ...R.
|
|
SOL_SOCKET SO_REUSEPORT ....r
|
|
|
|
|
|
# ./bindsnoop.py
|
|
Tracing binds ... Hit Ctrl-C to end
|
|
PID COMM PROT ADDR PORT OPTS IF
|
|
3941081 test_bind_op TCP 192.168.1.102 0 F.N.. 0
|
|
3940194 dig TCP :: 62087 ..... 0
|
|
3940219 dig UDP :: 48665 ..... 0
|
|
3940893 Acceptor Thr TCP :: 35343 ...R. 0
|
|
|
|
The output shows four bind system calls:
|
|
two "test_bind_op" instances, one with IP_FREEBIND and IP_BIND_ADDRESS_NO_PORT
|
|
options, dig process called bind for TCP and UDP sockets,
|
|
and Acceptor called bind for TCP with SO_REUSEADDR option set.
|
|
|
|
|
|
The -t option prints a timestamp column
|
|
|
|
# ./bindsnoop.py -t
|
|
TIME(s) PID COMM PROT ADDR PORT OPTS IF
|
|
0.000000 3956801 dig TCP :: 49611 ..... 0
|
|
0.011045 3956822 dig UDP :: 56343 ..... 0
|
|
2.310629 3956498 test_bind_op TCP 192.168.1.102 39609 F...r 0
|
|
|
|
|
|
The -U option prints a UID column:
|
|
|
|
# ./bindsnoop.py -U
|
|
Tracing binds ... Hit Ctrl-C to end
|
|
UID PID COMM PROT ADDR PORT OPTS IF
|
|
127072 3956498 test_bind_op TCP 192.168.1.102 44491 F...r 0
|
|
127072 3960261 Acceptor Thr TCP :: 48869 ...R. 0
|
|
0 3960729 Acceptor Thr TCP :: 44637 ...R. 0
|
|
0 3959075 chef-client UDP :: 61722 ..... 0
|
|
|
|
|
|
The -u option filtering UID:
|
|
|
|
# ./bindsnoop.py -Uu 0
|
|
Tracing binds ... Hit Ctrl-C to end
|
|
UID PID COMM PROT ADDR PORT OPTS IF
|
|
0 3966330 Acceptor Thr TCP :: 39319 ...R. 0
|
|
0 3968044 python3.7 TCP ::1 59371 ..... 0
|
|
0 10224 fetch TCP 0.0.0.0 42091 ...R. 0
|
|
|
|
|
|
The --cgroupmap option filters based on a cgroup set.
|
|
It is meant to be used with an externally created map.
|
|
|
|
# ./bindsnoop.py --cgroupmap /sys/fs/bpf/test01
|
|
|
|
For more details, see docs/special_filtering.md
|
|
|
|
|
|
In order to track heavy bind usage one can use --count option
|
|
# ./bindsnoop.py --count
|
|
Tracing binds ... Hit Ctrl-C to end
|
|
LADDR LPORT BINDS
|
|
0.0.0.0 6771 4
|
|
0.0.0.0 4433 4
|
|
127.0.0.1 33665 1
|
|
|
|
|
|
Usage message:
|
|
# ./bindsnoop.py -h
|
|
usage: bindsnoop.py [-h] [-t] [-w] [-p PID] [-P PORT] [-E] [-U] [-u UID]
|
|
[--count] [--cgroupmap CGROUPMAP] [--mntnsmap MNTNSMAP]
|
|
|
|
Trace TCP binds
|
|
|
|
optional arguments:
|
|
-h, --help show this help message and exit
|
|
-t, --timestamp include timestamp on output
|
|
-w, --wide wide column output (fits IPv6 addresses)
|
|
-p PID, --pid PID trace this PID only
|
|
-P PORT, --port PORT comma-separated list of ports to trace.
|
|
-E, --errors include errors in the output.
|
|
-U, --print-uid include UID on output
|
|
-u UID, --uid UID trace this UID only
|
|
--count count binds per src ip and port
|
|
--cgroupmap CGROUPMAP
|
|
trace cgroups in this BPF map only
|
|
|
|
examples:
|
|
./bindsnoop # trace all TCP bind()s
|
|
./bindsnoop -t # include timestamps
|
|
./bindsnoop -w # wider columns (fit IPv6)
|
|
./bindsnoop -p 181 # only trace PID 181
|
|
./bindsnoop -P 80 # only trace port 80
|
|
./bindsnoop -P 80,81 # only trace port 80 and 81
|
|
./bindsnoop -U # include UID
|
|
./bindsnoop -u 1000 # only trace UID 1000
|
|
./bindsnoop -E # report bind errors
|
|
./bindsnoop --count # count bind per src ip
|
|
./bindsnoop --cgroupmap mappath # only trace cgroups in this BPF map
|
|
./bindsnoop --mntnsmap mappath # only trace mount namespaces in the map
|
|
|
|
it is reporting socket options set before the bins call
|
|
impacting system call behavior:
|
|
SOL_IP IP_FREEBIND F....
|
|
SOL_IP IP_TRANSPARENT .T...
|
|
SOL_IP IP_BIND_ADDRESS_NO_PORT ..N..
|
|
SOL_SOCKET SO_REUSEADDR ...R.
|
|
SOL_SOCKET SO_REUSEPORT ....r
|
|
|
|
SO_BINDTODEVICE interface is reported as "IF" index
|