Skip to content

Instantly share code, notes, and snippets.

@anfernee
Last active May 26, 2023 06:23
Show Gist options
  • Save anfernee/8849503ca2d19dd6ebb24f79d570c6d6 to your computer and use it in GitHub Desktop.
Save anfernee/8849503ca2d19dd6ebb24f79d570c6d6 to your computer and use it in GitHub Desktop.

List available filter functions:

cat /sys/kernel/debug/tracing/available_filter_functions

ChatGPT says:

cat /proc/kallsyms | grep ' [Tt] '
# pwru --filter-port=80 --output-tuple
0xffff9154466182e8     10           [curl]             ip_local_out 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]           __ip_local_out 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]             nf_hook_slow 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]                ip_output 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]             nf_hook_slow 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]    apparmor_ip_postroute 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]         ip_finish_output 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]       __ip_finish_output 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]        ip_finish_output2 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]         __dev_queue_xmit 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]      netdev_core_pick_tx 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]        validate_xmit_skb 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]       netif_skb_features 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]     skb_network_protocol 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]  skb_csum_hwoffload_help 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]       validate_xmit_xfrm 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]      dev_hard_start_xmit 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]            loopback_xmit 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]   skb_clone_tx_timestamp 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]                tcp_wfree 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]           eth_type_trans 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]               __netif_rx 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]        netif_rx_internal 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]       enqueue_to_backlog 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]      __netif_receive_skb 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl] __netif_receive_skb_one_core 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]                   ip_rcv 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]              ip_rcv_core 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]             nf_hook_slow 127.0.0.1:45022->127.0.0.1:80(tcp)
0xffff9154466182e8     10           [curl]         ip_local_deliver 127.0.0.1:45022->127.0.0.1:80(tcp)

Result of curl google.com:

0xffff915879446ee8      4           [curl]             ip_local_out 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]           __ip_local_out 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]             nf_hook_slow 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]                ip_output 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]             nf_hook_slow 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]    apparmor_ip_postroute 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]         ip_finish_output 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]       __ip_finish_output 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]        ip_finish_output2 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]         __dev_queue_xmit 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]      netdev_core_pick_tx 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]           netdev_pick_tx 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]      __get_xps_queue_idx 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]          sch_direct_xmit 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]   validate_xmit_skb_list 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]        validate_xmit_skb 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]       netif_skb_features 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]  passthru_features_check 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]     skb_network_protocol 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8     22        [<empty>]         napi_consume_skb 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8     22        [<empty>]   skb_release_head_state 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8     22        [<empty>]                tcp_wfree 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8     22        [<empty>]         skb_release_data 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8     22        [<empty>]             kfree_skbmem 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]  skb_csum_hwoffload_help 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]       validate_xmit_xfrm 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]      dev_hard_start_xmit 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]       dev_queue_xmit_nit 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]                skb_clone 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]   skb_clone_tx_timestamp 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]             skb_to_sgvec 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915879446ee8      4           [curl]           __skb_to_sgvec 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915acb45b400      5        [<empty>]         tcp4_gro_receive 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]          tcp_gro_receive 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]   skb_defer_rx_timestamp 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]               packet_rcv 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]                 skb_push 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]              consume_skb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]              ip_rcv_core 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]             nf_hook_slow 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]              nf_checksum 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]           nf_ip_checksum 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]       tcp_v4_early_demux 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]     ip_route_input_noref 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]      ip_route_input_slow 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]      fib_validate_source 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]         ip_local_deliver 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]             nf_hook_slow 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]  ip_local_deliver_finish 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]  ip_protocol_deliver_rcu 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]        raw_local_deliver 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]               tcp_v4_rcv 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]               tcp_filter 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]       sk_filter_trim_cap 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]    security_sock_rcv_skb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>] apparmor_socket_sock_rcv_skb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>] bpf_lsm_socket_sock_rcv_skb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]           tcp_v4_fill_cb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]            tcp_v4_do_rcv 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]    tcp_rcv_state_process 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>]       tcp_finish_connect 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45b400      5        [<empty>] security_inet_conn_established 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff9158794454e8      4           [curl]             ip_local_out 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]           __ip_local_out 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]             nf_hook_slow 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]                ip_output 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]             nf_hook_slow 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]    apparmor_ip_postroute 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]         ip_finish_output 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]       __ip_finish_output 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]        ip_finish_output2 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]         __dev_queue_xmit 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]      netdev_core_pick_tx 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]           netdev_pick_tx 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]      __get_xps_queue_idx 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]          sch_direct_xmit 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]   validate_xmit_skb_list 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]        validate_xmit_skb 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]       netif_skb_features 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]  passthru_features_check 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]     skb_network_protocol 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]  skb_csum_hwoffload_help 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]       validate_xmit_xfrm 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]      dev_hard_start_xmit 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]       dev_queue_xmit_nit 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8      4           [curl]                skb_clone 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915acb45b100      4           [curl]         napi_consume_skb 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915acb45b100      4           [curl]      __dev_kfree_skb_any 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915acb45b100      4           [curl]              consume_skb 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915acb45b100      4           [curl]   skb_release_head_state 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915acb45b100      4           [curl]             __sock_wfree 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff915acb45b100      4           [curl]         skb_release_data 192.168.17.191:56810->142.250.191.78:80(tcp)
2023/05/26 06:08:47 Perf event ring buffer full, dropped 35 samples
0xffff915acb45aa00      5           [pwru]         tcp4_gro_receive 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5           [pwru]          tcp_gro_receive 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5           [pwru]   skb_defer_rx_timestamp 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5           [pwru]               packet_rcv 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5           [pwru]                 skb_push 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5           [pwru]              consume_skb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5           [pwru]              ip_rcv_core 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5           [pwru]             nf_hook_slow 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5           [pwru]              nf_checksum 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff9158794454e8     22           [node]         napi_consume_skb 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8     22           [node]   skb_release_head_state 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8     22           [node]                tcp_wfree 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8     22           [node]         skb_release_data 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8     22           [node]            skb_free_head 192.168.17.191:56810->142.250.191.78:80(tcp)
0xffff9158794454e8     22           [node]             kfree_skbmem 192.168.17.191:56810->142.250.191.78:80(tcp)
2023/05/26 06:08:47 Perf event ring buffer full, dropped 24 samples
0xffff915acb45aa00      5        [<empty>]         tcp4_gro_receive 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]          tcp_gro_receive 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]   skb_defer_rx_timestamp 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]               packet_rcv 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]                 skb_push 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]              consume_skb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]              ip_rcv_core 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]             nf_hook_slow 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]              nf_checksum 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]           nf_ip_checksum 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]       tcp_v4_early_demux 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]         ip_local_deliver 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]             nf_hook_slow 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]  ip_local_deliver_finish 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]  ip_protocol_deliver_rcu 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]        raw_local_deliver 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]               tcp_v4_rcv 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]               tcp_filter 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]       sk_filter_trim_cap 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]    security_sock_rcv_skb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>] apparmor_socket_sock_rcv_skb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>] bpf_lsm_socket_sock_rcv_skb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]           tcp_v4_fill_cb 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]            tcp_v4_do_rcv 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]      tcp_rcv_established 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]                  tcp_urg 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]           tcp_data_queue 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]            tcp_queue_rcv 142.250.191.78:80->192.168.17.191:56810(tcp)
0xffff915acb45aa00      5        [<empty>]      tcp_event_data_recv 142.250.191.78:80->192.168.17.191:56810(tcp)

5 kprobe progs attached:

7169: kprobe  name kprobe_skb_1  tag 60a7f9d498e0e001  gpl
        loaded_at 2023-05-26T06:11:12+0000  uid 0
        xlated 7624B  jited 7048B  memlock 8192B  map_ids 1407,1408,1409
        btf_id 223
7170: kprobe  name kprobe_skb_2  tag 48090bae46ce42a9  gpl
        loaded_at 2023-05-26T06:11:12+0000  uid 0
        xlated 7624B  jited 7043B  memlock 8192B  map_ids 1407,1408,1409
        btf_id 224
7171: kprobe  name kprobe_skb_3  tag 41b6afe6d7facf73  gpl
        loaded_at 2023-05-26T06:11:12+0000  uid 0
        xlated 7624B  jited 7035B  memlock 8192B  map_ids 1407,1408,1409
        btf_id 225
7172: kprobe  name kprobe_skb_4  tag 9aad8f2cea9db224  gpl
        loaded_at 2023-05-26T06:11:12+0000  uid 0
        xlated 7624B  jited 7026B  memlock 8192B  map_ids 1407,1408,1409
        btf_id 226
7173: kprobe  name kprobe_skb_5  tag c6a34bef56ea7e51  gpl
        loaded_at 2023-05-26T06:11:12+0000  uid 0
        xlated 7624B  jited 7031B  memlock 8192B  map_ids 1407,1408,1409
        btf_id 227
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment