From c7888ee08a3b93afe8bb13e421938159653553ac Mon Sep 17 00:00:00 2001 From: Alban Crequy Date: Wed, 5 Oct 2016 16:02:45 +0200 Subject: [PATCH] tcpv4tracer.py: eBPF: fix tcp dport --- docker/tcpv4tracer.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docker/tcpv4tracer.py b/docker/tcpv4tracer.py index d2f9f5d6d..c7abac49a 100755 --- a/docker/tcpv4tracer.py +++ b/docker/tcpv4tracer.py @@ -169,9 +169,10 @@ int kretprobe__inet_csk_accept(struct pt_regs *ctx) return 0; // pull in details - u16 family = 0, lport = 0; + u16 family = 0, lport = 0, dport = 0; bpf_probe_read(&family, sizeof(family), &newsk->__sk_common.skc_family); bpf_probe_read(&lport, sizeof(lport), &newsk->__sk_common.skc_num); + bpf_probe_read(&dport, sizeof(dport), &newsk->__sk_common.skc_dport); if (family == AF_INET) { struct tcp_event_t evt = {.type = "accept", .pid = pid >> 32}; @@ -180,7 +181,7 @@ int kretprobe__inet_csk_accept(struct pt_regs *ctx) bpf_probe_read(&evt.daddr, sizeof(u32), &newsk->__sk_common.skc_daddr); evt.sport = lport; - evt.dport = 0; + evt.dport = ntohs(dport); tcp_event.perf_submit(ctx, &evt, sizeof(evt)); } // else drop