tools: add option to include 'LPORT' in tcpconnlat, update man pages

Author: suresh2514

man/man8/tcpconnlat.8

@@ -2,7 +2,7 @@
 .SH NAME
 tcpconnlat \- Trace TCP active connection latency. Uses Linux eBPF/bcc.
 .SH SYNOPSIS
-.B tcpconnlat [\-h] [\-t] [\-p PID] [-v] [min_ms]
+.B tcpconnlat [\-h] [\-t] [\-p PID] [\-L] [-v] [min_ms]
 .SH DESCRIPTION
 This tool traces active TCP connections
 (eg, via a connect() syscall), and shows the latency (time) for the connection
@@ -31,6 +31,9 @@ Include a timestamp column.
 \-p PID
 Trace this process ID only (filtered in-kernel).
 .TP
+\-L
+Include a LPORT column.
+.TP
 \-v
 Print the resulting BPF program, for debugging purposes.
 .TP
@@ -50,6 +53,10 @@ Trace PID 181 only:
 #
 .B tcpconnlat \-p 181
 .TP
+Trace connects, and include LPORT:
+#
+.B tcpconnlat \-L
+.TP
 Trace connects with latency longer than 10 ms:
 #
 .B tcpconnlat 10
@@ -77,6 +84,9 @@ Source IP address.
 DADDR
 Destination IP address.
 .TP
+LPORT
+Source port
+.TP
 DPORT
 Destination port
 .TP

tools/tcpconnlat.py

@@ -13,6 +13,7 @@
 # Licensed under the Apache License, Version 2.0 (the "License")
 #
 # 19-Feb-2016   Brendan Gregg   Created this.
+# 15-Mar-2021   Suresh Kumar    Added LPORT option
 
 from __future__ import print_function
 from bcc import BPF
@@ -38,6 +39,7 @@ def positive_float(val):
     ./tcpconnlat 0.1       # trace connection latency slower than 100 us
     ./tcpconnlat -t        # include timestamps
     ./tcpconnlat -p 181    # only trace PID 181
+    ./tcpconnlat -L        # include LPORT while printing outputs
 """
 parser = argparse.ArgumentParser(
     description="Trace TCP connects and show connection latency",
@@ -47,6 +49,8 @@ def positive_float(val):
     help="include timestamp on output")
 parser.add_argument("-p", "--pid",
     help="trace this PID only")
+parser.add_argument("-L", "--lport", action="store_true",
+    help="include LPORT on output")
 parser.add_argument("duration_ms", nargs="?", default=0,
     type=positive_float,
     help="minimum duration to trace (ms)")
@@ -85,6 +89,7 @@ def positive_float(val):
     u32 saddr;
     u32 daddr;
     u64 ip;
+    u16 lport;
     u16 dport;
     u64 delta_us;
     char task[TASK_COMM_LEN];
@@ -97,6 +102,7 @@ def positive_float(val):
     unsigned __int128 saddr;
     unsigned __int128 daddr;
     u64 ip;
+    u16 lport;
     u16 dport;
     u64 delta_us;
     char task[TASK_COMM_LEN];
@@ -142,8 +148,9 @@ def positive_float(val):
 #endif
 
     // pull in details
-    u16 family = 0, dport = 0;
+    u16 family = 0, lport = 0, dport = 0;
     family = skp->__sk_common.skc_family;
+    lport = skp->__sk_common.skc_num;
     dport = skp->__sk_common.skc_dport;
 
     // emit to appropriate data path
@@ -152,6 +159,7 @@ def positive_float(val):
         data4.ts_us = now / 1000;
         data4.saddr = skp->__sk_common.skc_rcv_saddr;
         data4.daddr = skp->__sk_common.skc_daddr;
+        data4.lport = lport;
         data4.dport = ntohs(dport);
         data4.delta_us = delta_us;
         __builtin_memcpy(&data4.task, infop->task, sizeof(data4.task));
@@ -164,6 +172,7 @@ def positive_float(val):
             skp->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
         bpf_probe_read_kernel(&data6.daddr, sizeof(data6.daddr),
             skp->__sk_common.skc_v6_daddr.in6_u.u6_addr32);
+        data6.lport = lport;
         data6.dport = ntohs(dport);
         data6.delta_us = delta_us;
         __builtin_memcpy(&data6.task, infop->task, sizeof(data6.task));
@@ -208,11 +217,18 @@ def print_ipv4_event(cpu, data, size):
         if start_ts == 0:
             start_ts = event.ts_us
         print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="")
-    print("%-6d %-12.12s %-2d %-16s %-16s %-5d %.2f" % (event.pid,
-        event.task.decode('utf-8', 'replace'), event.ip,
-        inet_ntop(AF_INET, pack("I", event.saddr)),
-        inet_ntop(AF_INET, pack("I", event.daddr)), event.dport,
-        float(event.delta_us) / 1000))
+    if args.lport:
+        print("%-6d %-12.12s %-2d %-16s %-6d %-16s %-5d %.2f" % (event.pid,
+            event.task.decode('utf-8', 'replace'), event.ip,
+            inet_ntop(AF_INET, pack("I", event.saddr)), event.lport,
+            inet_ntop(AF_INET, pack("I", event.daddr)), event.dport,
+            float(event.delta_us) / 1000))
+    else:
+        print("%-6d %-12.12s %-2d %-16s %-16s %-5d %.2f" % (event.pid,
+            event.task.decode('utf-8', 'replace'), event.ip,
+            inet_ntop(AF_INET, pack("I", event.saddr)),
+            inet_ntop(AF_INET, pack("I", event.daddr)), event.dport,
+            float(event.delta_us) / 1000))
 
 def print_ipv6_event(cpu, data, size):
     event = b["ipv6_events"].event(data)
@@ -221,16 +237,27 @@ def print_ipv6_event(cpu, data, size):
         if start_ts == 0:
             start_ts = event.ts_us
         print("%-9.3f" % ((float(event.ts_us) - start_ts) / 1000000), end="")
-    print("%-6d %-12.12s %-2d %-16s %-16s %-5d %.2f" % (event.pid,
-        event.task.decode('utf-8', 'replace'), event.ip,
-        inet_ntop(AF_INET6, event.saddr), inet_ntop(AF_INET6, event.daddr),
-        event.dport, float(event.delta_us) / 1000))
+    if args.lport:
+        print("%-6d %-12.12s %-2d %-16s %-6d %-16s %-5d %.2f" % (event.pid,
+            event.task.decode('utf-8', 'replace'), event.ip,
+            inet_ntop(AF_INET6, event.saddr), event.lport,
+            inet_ntop(AF_INET6, event.daddr),
+            event.dport, float(event.delta_us) / 1000))
+    else:
+        print("%-6d %-12.12s %-2d %-16s %-16s %-5d %.2f" % (event.pid,
+            event.task.decode('utf-8', 'replace'), event.ip,
+            inet_ntop(AF_INET6, event.saddr), inet_ntop(AF_INET6, event.daddr),
+            event.dport, float(event.delta_us) / 1000))
 
 # header
 if args.timestamp:
     print("%-9s" % ("TIME(s)"), end="")
-print("%-6s %-12s %-2s %-16s %-16s %-5s %s" % ("PID", "COMM", "IP", "SADDR",
-    "DADDR", "DPORT", "LAT(ms)"))
+if args.lport:
+    print("%-6s %-12s %-2s %-16s %-6s %-16s %-5s %s" % ("PID", "COMM",
+        "IP", "SADDR", "LPORT", "DADDR", "DPORT", "LAT(ms)"))
+else:
+    print("%-6s %-12s %-2s %-16s %-16s %-5s %s" % ("PID", "COMM", "IP",
+        "SADDR", "DADDR", "DPORT", "LAT(ms)"))
 
 # read events
 b["ipv4_events"].open_perf_buffer(print_ipv4_event)

tools/tcpconnlat_example.txt

@@ -34,22 +34,24 @@ if the response is a RST (port closed).
 USAGE message:
 
 # ./tcpconnlat -h
-usage: tcpconnlat [-h] [-t] [-p PID] [min_ms]
+usage: tcpconnlat [-h] [-t] [-p PID] [-L] [-v] [duration_ms]
 
 Trace TCP connects and show connection latency
 
 positional arguments:
-  min_ms             minimum duration to trace, in ms (default 0)
+  duration_ms        minimum duration to trace (ms)
 
 optional arguments:
   -h, --help         show this help message and exit
   -t, --timestamp    include timestamp on output
   -p PID, --pid PID  trace this PID only
+  -L, --lport        include LPORT on output
+  -v, --verbose      print the BPF program for debugging purposes
 
 examples:
     ./tcpconnlat           # trace all TCP connect()s
+    ./tcpconnlat 1         # trace connection latency slower than 1 ms
+    ./tcpconnlat 0.1       # trace connection latency slower than 100 us
     ./tcpconnlat -t        # include timestamps
     ./tcpconnlat -p 181    # only trace PID 181
-    ./tcpconnlat 1         # only show connects longer than 1 ms
-    ./tcpconnlat 0.1       # only show connects longer than 100 us
-    ./tcpconnlat -v        # Show the BPF program
+    ./tcpconnlat -L        # include LPORT while printing outputs