trace_udp_rcvbuferrors.bt

trace_udp_rcvbuferrors.bt

// Tracks the origin of net_udp_rcvbuferrors, printing socket metadata associated with the packet drops.
//
// usage: bpftrace trace_udp_rcvbuferrors.bt
// sample output:
// 12:32:25 iperf3/3391 ::ffff:192.168.60.3:5201 -> ::ffff:192.168.60.1:50512 retval=-1 dropped=23809 qlen=36 qsize/qmaxsize=213248/212992 bytes

kprobe:udp_queue_rcv_skb
{
  $sock = (struct sock *)arg0;
  if ($sock->sk_type != SOCK_DGRAM || ($sock->__sk_common.skc_family != AF_INET && $sock->__sk_common.skc_family != AF_INET6)) {
    return;
  }
  //$usock = (struct udp_sock *)arg0;

  if ($sock->__sk_common.skc_family == AF_INET) {
    $daddr = ntop($sock->__sk_common.skc_daddr);
    $saddr = ntop($sock->__sk_common.skc_rcv_saddr);
  } else {
    $daddr = ntop($sock->__sk_common.skc_v6_daddr.in6_u.u6_addr8);
    $saddr = ntop($sock->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr8);
  }
  $lport = (uint16)$sock->__sk_common.skc_num & 0xFFFF;
  $dport = $sock->__sk_common.skc_dport;
  $dport = ($dport >> 8) | (($dport << 8) & 0x00FF00); // Use bwap() in later bpftrace versions to swap endianness

  $dropped = $sock->sk_drops.counter;
  $qlen = (uint32)$sock->sk_receive_queue.qlen;
  $qsize = $sock->sk_backlog.rmem_alloc.counter;
  $qmaxsize = $sock->sk_rcvbuf & 0xFFFFFFFF;

  @[tid] = (1, $saddr, $lport, $daddr, $dport, $dropped, $qlen, $qsize, $qmaxsize);
}

kretprobe:udp_queue_rcv_skb
{
  if (@[tid].0 != 1 || (int32)retval >= 0) {
    return;
  }

  // Un-comment to print a summary of kernel stack traces leading to the dropped packets at the end.
  //@kstacks[kstack] = count();

  time("%H:%M:%S ");
  printf("%s/%d\t", comm, pid);
  printf("%s:%d -> %s:%d\t", @[tid].1, @[tid].2, @[tid].3, @[tid].4);
  printf("retval=%d dropped=%d qlen=%u qsize/qmaxsize=%d/%d bytes\n", retval, @[tid].5, @[tid].6, @[tid].7, @[tid].8);

  delete(@[tid])
}

END
{
  clear(@);
}