simple bpftrace script to print out forwarding traffic

flow.bt

#!/bin/bpftrace

#include <linux/skbuff.h>
#include <linux/ip.h>

BEGIN
{
        printf("follow the white rabbit\n");
}

kprobe:netif_rx
{
        $skb = (struct sk_buff*) arg0;
        $ipheader = ((iphdr *) ($skb->head + $skb->network_header));
        $version = ($ipheader->version) >>4;
        printf("[%d] %d\t%s > %s\n", $version, $ipheader->protocol,
                ntop($ipheader->saddr), ntop($ipheader->daddr));
}

END
{
        printf("good bye, Alice\n");
}

iphdr * should be struct iphdr *

This gist is not maintend and therefore I don't recomment using it.