tcpv4tracer.py: eBPF: fix tcp dport

c7888ee0 · Alban Crequy · Lorenzo Manacorda · 4d948a58 · c7888ee0
Commit c7888ee0 authored 8 years ago by Alban Crequy Committed by Lorenzo Manacorda 8 years ago
Hide whitespace changes
Inline Side-by-side

Showing

with 3 additions and 2 deletions
+3 -2
--- a/docker/tcpv4tracer.py
+++ b/docker/tcpv4tracer.py
@@ -169,9 +169,10 @@ int kretprobe__inet_csk_accept(struct pt_regs *ctx)
 		return 0;

 	// pull in details
-	u16 family = 0, lport = 0;
+	u16 family = 0, lport = 0, dport = 0;
 	bpf_probe_read(&family, sizeof(family), &newsk->__sk_common.skc_family);
 	bpf_probe_read(&lport, sizeof(lport), &newsk->__sk_common.skc_num);
+	bpf_probe_read(&dport, sizeof(dport), &newsk->__sk_common.skc_dport);

 	if (family == AF_INET) {
 		struct tcp_event_t evt = {.type = "accept", .pid = pid >> 32};
@@ -180,7 +181,7 @@ int kretprobe__inet_csk_accept(struct pt_regs *ctx)
 		bpf_probe_read(&evt.daddr, sizeof(u32),
 			&newsk->__sk_common.skc_daddr);
 			evt.sport = lport;
-		evt.dport = 0;
+		evt.dport = ntohs(dport);
 		tcp_event.perf_submit(ctx, &evt, sizeof(evt));
 	}
 	// else drop