Skip to content

Instantly share code, notes, and snippets.

@aojea
Created September 28, 2025 21:45
Show Gist options
  • Select an option

  • Save aojea/9905450425306b448ced2da7b7a69f9c to your computer and use it in GitHub Desktop.

Select an option

Save aojea/9905450425306b448ced2da7b7a69f9c to your computer and use it in GitHub Desktop.
list sockets with bpftrace
#!/usr/bin/env bpftrace
#define AF_INET 2
#define AF_INET6 10
iter:tcp
{
$sk_common = ctx->sk_common;
if ($sk_common == 0) {
return;
}
$family = $sk_common->skc_family;
if ($family == AF_INET)
{
// Manually extract and print the IP address bytes
$s_b1 = ($sk_common->skc_rcv_saddr >> 24) & 0xFF;
$s_b2 = ($sk_common->skc_rcv_saddr >> 16) & 0xFF;
$s_b3 = ($sk_common->skc_rcv_saddr >> 8) & 0xFF;
$s_b4 = $sk_common->skc_rcv_saddr & 0xFF;
$d_b1 = ($sk_common->skc_daddr >> 24) & 0xFF;
$d_b2 = ($sk_common->skc_daddr >> 16) & 0xFF;
$d_b3 = ($sk_common->skc_daddr >> 8) & 0xFF;
$d_b4 = $sk_common->skc_daddr & 0xFF;
printf("State: %u, SRC: %d.%d.%d.%d:%u, DST: %d.%d.%d.%d:%u\n",
$sk_common->skc_state,
$s_b4, $s_b3, $s_b2, $s_b1,
$sk_common->skc_num,
$d_b4, $d_b3, $d_b2, $d_b1,
bswap($sk_common->skc_dport)
);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment