tcptracer-bpf

tcptracer-bpf is an eBPF program using kprobes to trace TCP events (connect, accept, close). The eBPF program is compiled to an ELF object file.

tcptracer-bpf also provides a Go library that provides a simple API for loading the ELF object file. Internally, it is using the gobpf elf package.

tcptracer-bpf does not have any run-time dependencies on kernel headers and is not tied to a specific kernel version or kernel configuration. This is quite unusual for eBPF programs using kprobes: for example, eBPF programs using kprobes with bcc are compiled on the fly and depend on kernel headers. And perf tools compiled for one kernel version cannot be used on another kernel version.

To adapt to the currently running kernel at run-time, tcptracer-bpf creates a series of TCP connections with known parameters (such as known IP addresses and ports) and discovers where those parameters are stored in the kernel struct sock. The offsets of the struct sock fields vary depending on the kernel version and kernel configuration. Since an eBPF programs cannot loop, tcptracer-bpf does not directly iterate over the possible offsets. It is instead controlled from userspace by the Go library using a state machine.

See tests/tracer.go for an example how to use tcptracer-bpf.

History

This is a StackState fork from the github.com/DataDog/tcptracer-bpf, which was itself forked from weavescope. We use the 'dd' branch from datadog as an upstream when merging.

DataDog's adaptation forcusses on gathering network metrics (also for UDP), StackState is adding connection tracking to the code again, loosely based on what the original weavescope tcptracer does.

Build the elf object

make

The object file can be found in ebpf/tcptracer-ebpf.o. It will be also embedded to ebpf/tcptracer-ebpf.go - this is how the file will end up in run-time.

So if you change /tcptracer-bpf.c you should build the ebpf/tcptracer-ebpf.go and commit it.

Run locally

make install-generated-go build-network-tracer
sudo reset-trace-bpfcc -F && sudo ./network-tracer

Testing using nettop

make build-nettop
sudo ./nettop

Testing

make test

Using Vagrant VM

$ vagrant up tcptracer
...
$ vagrant ssh tcptracer
$ cd /opt/stackstate-go/src/github.com/StackVista/tcptracer-bpf

Vendoring

We use gvt.

Getting Help

If you have any questions about, feedback for or problems with tcptracer-bpf:

• Invite yourself to the #weave-community slack channel.
• Ask a question on the #weave-community slack channel.
• Send an email to weave-users@weave.works
• File an issue.

Your feedback is always welcome!