Gecko [ www.jobworksschool.com ]

Name	Size	Permission	Date
lib	[ DIR ]	drwxr-xr-x	2025-11-05 21:34
argdist_example.txt	22.49 KB	-rw-r--r--	2023-12-08 15:36
bashreadline_example.txt	882 B	-rw-r--r--	2023-12-08 15:36
bindsnoop_example.txt	4.42 KB	-rw-r--r--	2023-12-08 15:36
biolatency_example.txt	23.46 KB	-rw-r--r--	2023-12-08 15:36
biolatpcts_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
biopattern_example.txt	1.37 KB	-rw-r--r--	2023-12-08 15:36
biosnoop_example.txt	3.47 KB	-rw-r--r--	2023-12-08 15:36
biotop_example.txt	9.11 KB	-rw-r--r--	2023-12-08 15:36
bitesize_example.txt	4.98 KB	-rw-r--r--	2023-12-08 15:36
bpflist_example.txt	2.13 KB	-rw-r--r--	2023-12-08 15:36
btrfsdist_example.txt	9.32 KB	-rw-r--r--	2023-12-08 15:36
btrfsslower_example.txt	6.65 KB	-rw-r--r--	2023-12-08 15:36
cachestat_example.txt	3.92 KB	-rw-r--r--	2023-12-08 15:36
cachetop_example.txt	3.83 KB	-rw-r--r--	2023-12-08 15:36
capable_example.txt	6.5 KB	-rw-r--r--	2023-12-08 15:36
cobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
compactsnoop_example.txt	9.92 KB	-rw-r--r--	2023-12-08 15:36
cpudist_example.txt	16.48 KB	-rw-r--r--	2023-12-08 15:36
cpuunclaimed_example.txt	15.2 KB	-rw-r--r--	2023-12-08 15:36
criticalstat_example.txt	4.81 KB	-rw-r--r--	2023-12-08 15:36
cthreads_example.txt	2.08 KB	-rw-r--r--	2023-12-08 15:36
dbslower_example.txt	3.89 KB	-rw-r--r--	2023-12-08 15:36
dbstat_example.txt	6.5 KB	-rw-r--r--	2023-12-08 15:36
dcsnoop_example.txt	4.27 KB	-rw-r--r--	2023-12-08 15:36
dcstat_example.txt	3.26 KB	-rw-r--r--	2023-12-08 15:36
deadlock_example.txt	16.25 KB	-rw-r--r--	2023-12-08 15:36
dirtop_example.txt	4.98 KB	-rw-r--r--	2023-12-08 15:36
drsnoop_example.txt	5 KB	-rw-r--r--	2023-12-08 15:36
execsnoop_example.txt	6.64 KB	-rw-r--r--	2023-12-08 15:36
exitsnoop_example.txt	6.22 KB	-rw-r--r--	2023-12-08 15:36
ext4dist_example.txt	8.78 KB	-rw-r--r--	2023-12-08 15:36
ext4slower_example.txt	11.07 KB	-rw-r--r--	2023-12-08 15:36
filegone_example.txt	743 B	-rw-r--r--	2023-12-08 15:36
filelife_example.txt	2.04 KB	-rw-r--r--	2023-12-08 15:36
fileslower_example.txt	5.58 KB	-rw-r--r--	2023-12-08 15:36
filetop_example.txt	6.8 KB	-rw-r--r--	2023-12-08 15:36
funccount_example.txt	13.29 KB	-rw-r--r--	2023-12-08 15:36
funcinterval_example.txt	15.28 KB	-rw-r--r--	2023-12-08 15:36
funclatency_example.txt	20.98 KB	-rw-r--r--	2023-12-08 15:36
funcslower_example.txt	6.63 KB	-rw-r--r--	2023-12-08 15:36
gethostlatency_example.txt	1.29 KB	-rw-r--r--	2023-12-08 15:36
hardirqs_example.txt	37.05 KB	-rw-r--r--	2023-12-08 15:36
inject_example.txt	6.67 KB	-rw-r--r--	2023-12-08 15:36
javacalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
javaflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
javagc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
javaobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
javastat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
javathreads_example.txt	2.08 KB	-rw-r--r--	2023-12-08 15:36
killsnoop_example.txt	1.31 KB	-rw-r--r--	2023-12-08 15:36
klockstat_example.txt	8.34 KB	-rw-r--r--	2023-12-08 15:36
kvmexit_example.txt	11.63 KB	-rw-r--r--	2023-12-08 15:36
llcstat_example.txt	3.24 KB	-rw-r--r--	2023-12-08 15:36
mdflush_example.txt	1.74 KB	-rw-r--r--	2023-12-08 15:36
memleak_example.txt	10.02 KB	-rw-r--r--	2023-12-08 15:36
mountsnoop_example.txt	1.45 KB	-rw-r--r--	2023-12-08 15:36
mysqld_qslower_example.txt	2.3 KB	-rw-r--r--	2023-12-08 15:36
netqtop_example.txt	12.2 KB	-rw-r--r--	2023-12-08 15:36
nfsdist_example.txt	8.31 KB	-rw-r--r--	2023-12-08 15:36
nfsslower_example.txt	7.68 KB	-rw-r--r--	2023-12-08 15:36
nodegc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
nodestat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
offcputime_example.txt	19.2 KB	-rw-r--r--	2023-12-08 15:36
offwaketime_example.txt	37.36 KB	-rw-r--r--	2023-12-08 15:36
oomkill_example.txt	1.88 KB	-rw-r--r--	2023-12-08 15:36
opensnoop_example.txt	10.33 KB	-rw-r--r--	2023-12-08 15:36
perlcalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
perlflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
perlstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
phpcalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
phpflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
phpstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
pidpersec_example.txt	677 B	-rw-r--r--	2023-12-08 15:36
ppchcalls_example.txt	6.93 KB	-rw-r--r--	2023-12-08 15:36
profile_example.txt	31.08 KB	-rw-r--r--	2023-12-08 15:36
pythoncalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
pythonflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
pythongc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
pythonstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
rdmaucma_example.txt	1.94 KB	-rw-r--r--	2023-12-08 15:36
readahead_example.txt	3.17 KB	-rw-r--r--	2023-12-08 15:36
reset-trace_example.txt	9.15 KB	-rw-r--r--	2023-12-08 15:36
rubycalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
rubyflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
rubygc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
rubyobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
rubystat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
runqlat_example.txt	31.3 KB	-rw-r--r--	2023-12-08 15:36
runqlen_example.txt	11.85 KB	-rw-r--r--	2023-12-08 15:36
runqslower_example.txt	2.13 KB	-rw-r--r--	2023-12-08 15:36
shmsnoop_example.txt	2.73 KB	-rw-r--r--	2023-12-08 15:36
slabratetop_example.txt	5.22 KB	-rw-r--r--	2023-12-08 15:36
sofdsnoop_example.txt	3.14 KB	-rw-r--r--	2023-12-08 15:36
softirqs_example.txt	11.02 KB	-rw-r--r--	2023-12-08 15:36
solisten_example.txt	2.3 KB	-rw-r--r--	2023-12-08 15:36
sslsniff_example.txt	6.74 KB	-rw-r--r--	2023-12-08 15:36
stackcount_example.txt	21.45 KB	-rw-r--r--	2023-12-08 15:36
statsnoop_example.txt	3.02 KB	-rw-r--r--	2023-12-08 15:36
swapin.txt	2.57 KB	-rw-r--r--	2023-12-08 15:36
swapin_example.txt	1.39 KB	-rw-r--r--	2023-12-08 15:36
syncsnoop_example.txt	387 B	-rw-r--r--	2023-12-08 15:36
syscount_example.txt	6.27 KB	-rw-r--r--	2023-12-08 15:36
tclcalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
tclflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
tclobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
tclstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
tcpaccept_example.txt	2.76 KB	-rw-r--r--	2023-12-08 15:36
tcpcong_example.txt	33.31 KB	-rw-r--r--	2023-12-08 15:36
tcpconnect_example.txt	6.27 KB	-rw-r--r--	2023-12-08 15:36
tcpconnlat_example.txt	2.55 KB	-rw-r--r--	2023-12-08 15:36
tcpdrop_example.txt	1.95 KB	-rw-r--r--	2023-12-08 15:36
tcplife_example.txt	6.83 KB	-rw-r--r--	2023-12-08 15:36
tcpretrans_example.txt	3.85 KB	-rw-r--r--	2023-12-08 15:36
tcprtt_example.txt	9.83 KB	-rw-r--r--	2023-12-08 15:36
tcpstates_example.txt	2.84 KB	-rw-r--r--	2023-12-08 15:36
tcpsubnet_example.txt	5.37 KB	-rw-r--r--	2023-12-08 15:36
tcpsynbl_example.txt	1.15 KB	-rw-r--r--	2023-12-08 15:36
tcptop_example.txt	5.75 KB	-rw-r--r--	2023-12-08 15:36
tcptracer_example.txt	1.98 KB	-rw-r--r--	2023-12-08 15:36
threadsnoop_example.txt	1.07 KB	-rw-r--r--	2023-12-08 15:36
tplist_example.txt	4.4 KB	-rw-r--r--	2023-12-08 15:36
trace_example.txt	21.62 KB	-rw-r--r--	2023-12-08 15:36
ttysnoop_example.txt	3.24 KB	-rw-r--r--	2023-12-08 15:36
vfscount_example.txt	2.17 KB	-rw-r--r--	2023-12-08 15:36
vfsstat_example.txt	1.66 KB	-rw-r--r--	2023-12-08 15:36
virtiostat_example.txt	2.62 KB	-rw-r--r--	2023-12-08 15:36
wakeuptime_example.txt	33.25 KB	-rw-r--r--	2023-12-08 15:36
xfsdist_example.txt	6.77 KB	-rw-r--r--	2023-12-08 15:36
xfsslower_example.txt	6.91 KB	-rw-r--r--	2023-12-08 15:36
zfsdist_example.txt	9.52 KB	-rw-r--r--	2023-12-08 15:36
zfsslower_example.txt	7.37 KB	-rw-r--r--	2023-12-08 15:36

Rename

Demonstrations of tcpaccept, the Linux eBPF/bcc version.

This tool traces the kernel function accepting TCP socket connections (eg, a
passive connection via accept(); not connect()). Some example output (IP
addresses changed to protect the innocent):

# ./tcpaccept
PID    COMM         IP RADDR            RPORT  LADDR            LPORT
907    sshd         4  192.168.56.1     32324  192.168.56.102   22
907    sshd         4  127.0.0.1        39866  127.0.0.1        22
5389   perl         6  1234:ab12:2040:5020:2299:0:5:0 52352 1234:ab12:2040:5020:2299:0:5:0 7001

This output shows three connections, two IPv4 connections to PID 907, an "sshd"
process listening on port 22, and one IPv6 connection to a "perl" process
listening on port 7001.

The overhead of this tool should be negligible, since it is only tracing the
kernel function performing accept. It is not tracing every packet and then
filtering.

This tool only traces successful TCP accept()s. Connection attempts to closed
ports will not be shown (those can be traced via other functions).

The -t option prints a timestamp column:

# ./tcpaccept -t
TIME(s)  PID    COMM         IP RADDR            RPORT LADDR            LPORT
0.000    907    sshd         4  127.0.0.1        53700 127.0.0.1        22
0.010    5389   perl         6  1234:ab12:2040:5020:2299:0:5:0 40614 1234:ab12:2040:5020:2299:0:5:0 7001
0.992    907    sshd         4  127.0.0.1        32548 127.0.0.1        22
1.984    907    sshd         4  127.0.0.1        51250 127.0.0.1        22

The --cgroupmap option filters based on a cgroup set. It is meant to be used
with an externally created map.

# ./tcpaccept --cgroupmap /sys/fs/bpf/test01

For more details, see docs/special_filtering.md

USAGE message:

# ./tcpaccept -h
usage: tcpaccept.py [-h] [-T] [-t] [-p PID] [-P PORT] [-4 | -6] [--cgroupmap CGROUPMAP]

Trace TCP accepts

optional arguments:
  -h, --help            show this help message and exit
  -T, --time            include time column on output (HH:MM:SS)
  -t, --timestamp       include timestamp on output
  -p PID, --pid PID     trace this PID only
  -P PORT, --port PORT  comma-separated list of local ports to trace
  -4, --ipv4            trace IPv4 family only
  -6, --ipv6            trace IPv6 family only
  --cgroupmap CGROUPMAP
                        trace cgroups in this BPF map only

examples:
    ./tcpaccept           # trace all TCP accept()s
    ./tcpaccept -t        # include timestamps
    ./tcpaccept -P 80,81  # only trace port 80 and 81
    ./tcpaccept -p 181    # only trace PID 181
    ./tcpaccept --cgroupmap mappath  # only trace cgroups in this BPF map
    ./tcpaccept --mntnsmap mappath   # only trace mount namespaces in the map
    ./tcpaccept -4        # trace IPv4 family only
    ./tcpaccept -6        # trace IPv6 family only