udpsnoop.d

gistfile1.c

#!/usr/bin/env dtrace -s

typedef struct sockaddr_in {
	short sin_family;
	unsigned short sin_port;
	unsigned char a0;
	unsigned char a1;
	unsigned char a2;
	unsigned char a3;
} sockaddr_in_t;

BEGIN
{
	bound[-1, -1] = 0;
	dgram[-1, -1] = 0;
}

syscall::socket:entry
/arg1 == 2/
{
	/* SOCK_DGRAM */
	this->mon = 1;
}

syscall::socket:return
/this->mon == 1/
{
	dgram[pid, arg1] = 1;
	printf("%s(%d) DGRAM fd %d", execname, pid, arg1);
}

syscall::bind:entry
/dgram[pid, arg1] == 1/
{
	this->fd = arg0;
	this->sinaddr = arg1;
}

syscall::bind:return
/this->sinaddr && this->fd >= 0/
{
        this->sin = (struct sockaddr_in *)copyin(this->sinaddr, sizeof(struct sockaddr_in));
        printf("%s(%d):%d -- %d.%d.%d.%d:%hu", execname, pid, this->fd,
                        this->sin->a0,
                        this->sin->a1,
                        this->sin->a2,
                        this->sin->a3,
                        this->sin->sin_port);
	bound[pid, this->fd] = 1;
}

syscall::read:entry,
syscall::readv:entry,
syscall::preadv:entry,
syscall::pread64:entry
/bound[pid, arg0] == 1/
{
	printf("%s(%d):%d recv", execname, pid, arg0);
}

syscall::recvfrom:entry
{
	this->sinaddr = arg4;
	this->fd = arg0;
}

syscall::recvfrom:return
/this->sinaddr == NULL/
{
	printf("%s(%d):%d", execname, pid, this->fd);
}

syscall::recvfrom:return
/this->sinaddr != NULL/
{
        this->sin = (struct sockaddr_in *)copyin(this->sinaddr, sizeof(struct sockaddr_in));
        printf("%s(%d):%d -- %d.%d.%d.%d:%hu", execname, pid, this->fd,
                        this->sin->a0,
                        this->sin->a1,
                        this->sin->a2,
                        this->sin->a3,
                        this->sin->sin_port);
}

syscall::close:entry
/bound[pid, arg0] == 1 || dgram[pid, arg0] == 1/
{
	printf("%s(%d):%d", execname, pid, arg0);
}

syscall::close:entry
/bound[pid, arg0] == 1/
{
	bound[pid, arg0] = 0;
}

syscall::close:entry
/dgram[pid, arg0] == 1/
{
	dgram[pid, arg0] = 0;
}