This SNMP group of tapsets provides probes used to count SNMP management

events.  The probes mirror many of the SNMP statistics defined
in /usr/include/linux/snmp.h.  Each probe represents a single SNMP
statistic or MIB. Each of the probe's handler is called when system
performs an operation that would alter the associated statistic. Along
with each probe is defined an indexed set of counters used to record
probe hits. The probe handlers call a user supplied callback functions
to determine which counter to alter. The user's callback should returns a
key value that will be used to index the counter. For example a callback
could return a unique value for each socket. This would results in a
separate counter being used for each socket.

tcpipstat.stp shows how snmp tapsets could be used. Tcpipstat collects and
displays network statistics related to individual TCP sockets or groups of
sockets. The statistics that are collected are simmer to that of the command
netstat -s, only sorted and grouped by individual sockets.
Signed-off-by: David Wilder <dwilder@us.ibm.com>

11 files changed, 1805 insertions, 1 deletions

diff --git a/configure.ac b/configure.ac
index 747aac97..c7ccd2da 100644
--- a/configure.ac
+++ b/configure.ac
@@ -580,7 +580,7 @@ dnl Don't use this directly (when not given it is set to NONE).
 AC_DEFINE_UNQUOTED(STAP_PREFIX, "$prefix", [configure prefix location])
 
 AC_CONFIG_HEADERS([config.h:config.in])
-AC_CONFIG_FILES(Makefile doc/Makefile doc/SystemTap_Tapset_Reference/Makefile grapher/Makefile stap.1 stapprobes.3stap stapfuncs.3stap stapvars.3stap stapex.3stap staprun.8 stap-server.8 man/stapprobes.iosched.3stap man/stapprobes.netdev.3stap man/stapprobes.nfs.3stap man/stapprobes.nfsd.3stap man/stapprobes.pagefault.3stap man/stapprobes.kprocess.3stap man/stapprobes.rpc.3stap man/stapprobes.scsi.3stap man/stapprobes.signal.3stap man/stapprobes.socket.3stap man/stapprobes.tcp.3stap man/stapprobes.udp.3stap initscript/systemtap)
+AC_CONFIG_FILES(Makefile doc/Makefile doc/SystemTap_Tapset_Reference/Makefile grapher/Makefile stap.1 stapprobes.3stap stapfuncs.3stap stapvars.3stap stapex.3stap staprun.8 stap-server.8 man/stapprobes.iosched.3stap man/stapprobes.netdev.3stap man/stapprobes.nfs.3stap man/stapprobes.nfsd.3stap man/stapprobes.pagefault.3stap man/stapprobes.kprocess.3stap man/stapprobes.rpc.3stap man/stapprobes.scsi.3stap man/stapprobes.signal.3stap man/stapprobes.socket.3stap man/stapprobes.tcp.3stap man/stapprobes.udp.3stap man/stapprobes.snmp.3stap initscript/systemtap)
 AC_CONFIG_SUBDIRS(testsuite)
 if test $enable_translator == "yes"; then
 	AC_CONFIG_FILES([run-stap], [chmod +x run-stap])
diff --git a/man/stapprobes.snmp.3stap.in b/man/stapprobes.snmp.3stap.in
new file mode 100644
index 00000000..3c606932
--- /dev/null
+++ b/man/stapprobes.snmp.3stap.in
@@ -0,0 +1,138 @@
+.\" -*- nroff -*-
+.TH STAPPROBES.SNMP 3stap @DATE@ "IBM"
+.SH NAME
+stapprobes.snmp \- Systemtap simple network management protocol probe points.
+
+.\" macros
+.de SAMPLE
+.br
+.RS
+.nf
+.nh
+..
+.de ESAMPLE
+.hy
+.fi
+.RE
+..
+
+.SH DESCRIPTION
+
+This family of probe points enhances the Linux system's implementation of the Simple Network Management Protocol
+.B (SNMP)
+by allowing the user to collect per-socket statistics. SNMP data is collected in the Linux kernel by counting various events occurring in the networking subsystem. Linux provides one counter for each type of event, thus providing a system-wide collection of network statistics. These statistics can be viewed with the command:
+.B netstat -s. 
+
+The probpoints defined in the SNMP group of tapsets allow users to aberrate each SNMP counter into groups of counters. For example, the user may count SNMP events for a single network socket or for a group of sockets.
+
+Severals SNMP tapsets have been created. Each tapset represents a single layer of the network stack and defines a group of counters called management information blocks or MIBs. Currently tapsets are provided that support MIBS for IP, TCP layers and the enhanced linux MIB. See the file /usr/include/linux/snmp.h for a list of MIBS supported by linux.
+
+.SH PROBE HANDLERS, COUNTERS AND CALLBACKS
+
+Each probe represents a single SNMP statistic. The probe's handler is called each time the system performs an operation that would alter the associated statistic. Each probe also defines an indexed set of counters used to record probe hits. The probe handler calls a user supplied callback functions to determine which counter to alter. The user's callback should return a key value that will be used to index the counter. For example a callback could return a unique value for each socket. This would results in a separate counter being used for each socket. 
+
+Each tapset is now described. Examples of probe names and counter names are given. See the  tapset itself for a complete list of supported probes. Users of the tapset must provide a callback function matching the name and prototype as shown. 
+
+.P
+.TP
+.B IP MIB Tapset:
+.P File name: ipmib.stp
+
+Example probe name:
+.I ipmib.InReceives
+
+Example counter name:
+.I InReceives
+
+Callback prototype:  
+
+.I ipmib_filter_key:long  (skb:long,  op:long,  SourceIsLocal:long)
+
+This user supplied function should compute and return a value used to index the statistical counter. The 
+.I skb
+is a pointer to the 
+.B struct sk_buff
+being processed at the time. The local ip-address and port number will be located in either the source or destination fields of the network packet.
+.I SourceIsLocal
+will be true if the local address is in the source field. The probe handler will add the value of
+.I op
+to the counter. To skip counting the event return a value of zero.
+
+.P
+.TP
+.B TCP MIB tapset:
+.P File name: tcpmib.stp
+
+Example probe name:
+.I tcpmib.InSegs
+
+Example counter name:
+.I InSegs
+
+Callback prototype:  
+
+.I tcpmib_filter_key:long (sk:long, op:long)
+
+This user supplied function should compute and return a value used to index the statistical counter. The
+.I sk
+is a pointer to the
+.B struct sock
+being processed at the time. The probe handler will add the value of
+.I op
+to the counter. To skip counting the event return a value of zero.
+
+.P
+.TP
+.B LINUX MIB tapset:
+.P File name:
+.I linuxmib.stp
+
+Example probe name:
+.I linuxmib.DelayedACKs 
+
+Example counter name:
+.I DelayedACKs
+
+Callback prototype:  
+
+.I linuxmib_filter_key:long (sk:long, op:long)
+
+This user supplied function should compute and return a value used to index the statistical counter. The
+.I sk
+is a pointer to the 
+.B struct sock
+being processed at the time. The probe handler will add the value of
+.I op
+to the counter. To skip counting the event return a value of zero.  
+
+.SH EXAMPLE  
+This example script counts the number of TCP retransmits and records them per-remote address. It displays the counts when terminated.
+
+.SAMPLE
+/* Enable the statistic we want to record. */
+probe tcpmib.RetransSegs {}
+
+/*
+ * Find the remote address and return 
+ * it as an index to the counter array.
+ */
+function tcpmib_filter_key: long ( sk:long, op:long ){
+	if ( !sk ) return 0;
+	raddr = sk_get_daddr(sk);
+	return raddr
+}
+
+/* Print the results. */
+probe end {
+	foreach (addr in  RetransSegs )
+		printf ("%s  %d \n ",ip_ntop(htonl(addr)), lport)
+}
+.ESAMPLE
+	
+.SH FILES
+/usr/share/doc/systemtap*/examples/tcpipstat.stp
+
+.SH SEE ALSO
+.IR stap (1),
+.IR stapprobes (3stap),
+.IR stapfuncs (3stap)
diff --git a/tapset/ipmib.stp b/tapset/ipmib.stp
new file mode 100644
index 00000000..3430a8a1
--- /dev/null
+++ b/tapset/ipmib.stp
@@ -0,0 +1,514 @@
+/*
+ *      Copyright (C) 2009 IBM Corp.
+ *      This file is part of systemtap, and is free software.  You can
+ *      redistribute it and/or modify it under the terms of the GNU General
+ *      Public License (GPL); either version 2, or (at your option) any
+ *      later version.
+ *      
+ *      Version 1.0     wilder@us.ibm.com     2009-07-06
+ */
+
+%{ /* pure */
+#include <net/route.h>
+#include <linux/skbuff.h>
+#include <linux/icmp.h>
+#include <linux/rtnetlink.h>
+#include <linux/tcp.h>
+%}
+
+
+/* Commented globals represent statistics that are not supported in this
+ * version. 
+ */
+global InReceives
+// global InHdrErrors
+// global InTooBigErrors
+global InNoRoutes  
+global InAddrErrors
+global InUnknownProtos
+// global InTruncatedPkts
+global InDiscards // included counts of InHdrErrors InTruncatedPkts
+// global InDelivers
+global ForwDatagrams
+global OutRequests
+// global OutDiscards
+// global OutNoRoutes
+global ReasmTimeout
+global ReasmReqds
+//global ReasmOKs
+// global ReasmFails
+global FragOKs
+global FragFails
+// global FragCreates
+global InMcastPkts
+global OutMcastPkts
+global InBcastPkts
+global OutBcastPkts
+
+/**
+ * sfunction ipmib_remote_addr - Get the remote ip address.
+ *
+ * Returns the remote ip address from an sk_buff.
+ * @skb: Pointer to a struct sk_buff.
+ *
+ */
+function ipmib_remote_addr:long (skb:long, SourceIsLocal:long)
+{
+	iphdr = __get_skb_iphdr(skb);
+	if ( SourceIsLocal )
+		return ntohl(__ip_skb_daddr(iphdr));
+	return ntohl(__ip_skb_saddr(iphdr));
+}
+
+/**
+ * sfunction ipmib_local_addr - Get the local ip address.
+ *
+ * Returns the local ip address from an sk_buff.
+ * @skb: Pointer to a struct sk_buff.
+ *
+ */
+function ipmib_local_addr:long (skb:long, SourceIsLocal:long)
+{
+	iphdr = __get_skb_iphdr(skb);
+	if ( SourceIsLocal )
+		return ntohl(__ip_skb_saddr(iphdr));
+	return ntohl(__ip_skb_daddr(iphdr));
+}
+
+/**
+ * sfunction ipmib_tcp_remote_port - Get the remote tcp port.
+ *
+ * Returns the remote tcp port from an sk_buff.
+ * @skb: Pointer to a struct sk_buff.
+ *
+ */
+function ipmib_tcp_remote_port:long (skb:long, SourceIsLocal:long)
+{
+	th = _plunge_into_tcphdr(skb);
+	if ( SourceIsLocal )
+		return _tcphdr_get_dport(th);
+	return _tcphdr_get_sport(th);
+}
+
+/**
+ * sfunction ipmib_tcp_local_port - Get the local tcp port.
+ *
+ * Returns the local tcp port from an sk_buff.
+ * @skb: Pointer to a struct sk_buff.
+ *
+ */
+function ipmib_tcp_local_port:long (skb:long, SourceIsLocal:long)
+{
+	th = _plunge_into_tcphdr(skb);
+	if ( SourceIsLocal )
+		return _tcphdr_get_sport(th);
+	return _tcphdr_get_dport(th);
+}
+
+/**
+ * sfunction ipmib_get_proto - Get the protocol value
+ *
+ * Returns the protocol value from ip header.
+ * @skb: Pointer to a struct sk_buff.
+ *
+ */
+function ipmib_get_proto:long (skb:long)
+{
+	iphdr = __get_skb_iphdr(skb);
+	return __ip_skb_proto(iphdr);
+}
+
+/* Internal functions */
+
+/*
+ * We can't assume the pointer to the sk_buff->transport_header 
+ * has been updated, so we must calculate the value from the network_header.
+ * The caller must verify the skb is for a tcpip packet.
+ */
+function _plunge_into_tcphdr:long (skb:long)
+%{
+	struct sk_buff *skb = (struct sk_buff *)(long)THIS->skb;
+	/* as done by skb_network_header() */
+	#ifdef NET_SKBUFF_DATA_USES_OFFSET
+		THIS->__retvalue=(long)kread(&(skb->network_header)) +
+		(long)(kread(&(skb->head))) +
+		(long)sizeof(struct tcphdr);
+	#else
+		THIS->__retvalue=(long)kread(&(skb->network_header)) +
+		(long)sizeof(struct tcphdr);
+	#endif
+	CATCH_DEREF_FAULT();
+%}
+
+function _tcphdr_get_sport:long (th:long)
+%{ /* pure */
+	struct tcphdr *th = (struct tcphdr *) (long) THIS->th;
+	THIS->__retvalue = ntohs(kread(&(th->source)));
+	CATCH_DEREF_FAULT();
+%}
+
+function _tcphdr_get_dport:long (th:long)
+%{ /* pure */
+	struct tcphdr *th = (struct tcphdr *) (long) THIS->th;
+	THIS->__retvalue = ntohs(kread(&(th->dest)));
+	CATCH_DEREF_FAULT();
+%}
+
+function _ehostunreach:long ()
+%{
+	THIS->__retvalue = EHOSTUNREACH;
+%}
+
+function _enetunreach:long ()
+%{
+	THIS->__retvalue = ENETUNREACH;
+%}
+
+function _icmp_dest_unreach:long ()
+%{
+	THIS->__retvalue = ICMP_DEST_UNREACH;
+%}
+
+function _icmp_prot_unreach:long ()
+%{
+	THIS->__retvalue = ICMP_PROT_UNREACH;
+%}
+
+function _net_rx_drop:long ()
+%{
+	THIS->__retvalue = NET_RX_DROP;
+%}
+
+function _icmp_time_exceeded:long ()
+%{
+	THIS->__retvalue = ICMP_TIME_EXCEEDED;
+%}
+
+function _icmp_exc_fragtime:long ()
+%{
+	THIS->__retvalue = ICMP_EXC_FRAGTIME;
+%}
+
+function _rtn_multicast:long ()
+%{
+	THIS->__retvalue = RTN_MULTICAST;
+%}
+
+function _rtn_broadcast:long ()
+%{
+	THIS->__retvalue = RTN_BROADCAST;
+%}
+
+/**
+ * probe tcpmib.InReceives - Count an arriving packet.
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: InReceives
+ * MIB: IPSTATS_MIB_INRECEIVES
+ *
+ */
+probe ipmib.InReceives=kernel.function("ip_rcv")
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 0;
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) InReceives[key] += op;
+}
+
+/**
+ * probe tcpmib.InNoRoutes - Count an arriving packet with no matching socket.
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: InNoRoutes
+ * MIB: IPSTATS_MIB_INNOROUTES
+ *
+ */
+probe ipmib.InNoRoutes=kernel.function("ip_route_input").return
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 0;
+	if ( $return != -_enetunreach()) next;
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) InNoRoutes[key] += op;
+}
+
+/**
+ * probe tcpmib.InAddrErrors - Count arriving packets with an incorrect address.
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: InAddrErrors
+ * MIB: IPSTATS_MIB_INADDRERRORS
+ *
+ */
+probe ipmib.InAddrErrors=kernel.function("ip_route_input").return
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 0;
+	if ( $return != -_ehostunreach()) next;
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) InAddrErrors[key] += op;
+}
+
+/**
+ * probe tcpmib.InUnknownProtos - Count arriving packets with an unbound proto. 
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: InUnknownProtos
+ * MIB: IPSTATS_MIB_INUNKNOWNPROTOS
+ *
+ */
+
+/* icmp_send() is called by ip_local_deliver_finish() */
+probe ipmib.InUnknownProtos=kernel.function("icmp_send")
+{
+	skb = $skb_in;
+	op = 1;
+	SourceIsLocal = 0;
+	if (($type==_icmp_dest_unreach())&&($code==_icmp_prot_unreach())){ 
+		key = ipmib_filter_key(skb,op,SourceIsLocal);
+		if ( key ) InUnknownProtos[key] += op;
+	}
+}
+
+/**
+ * probe tcpmib.InDiscards - Count discarded inbound packets.
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: InDiscards
+ * MIB: STATS_MIB_INDISCARDS
+ *
+ */
+
+/*
+   This stat combines all instances of IPSTATS_MIB_INHDRERRORS,
+   IPSTATS_MIB_INTRUNCATEDPKTS, and STATS_MIB_INDISCARDS.
+*/
+probe ipmib.InDiscards=kernel.function("ip_rcv").return
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 0;
+	if ( $return != _net_rx_drop() ) next;
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) InDiscards[key] += op;
+}
+
+/**
+ * probe tcpmib.ForwDatagrams
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: ForwDatagrams
+ * MIB: IPSTATS_MIB_OUTFORWDATAGRAMS
+ *
+ */
+probe ipmib.ForwDatagrams=kernel.function("ip_forward_finish"),
+			 kernel.function("ipmr_forward_finish")
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 0;
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) ForwDatagrams[key] += op;
+}
+
+/**
+ * probe tcpmib.OutRequests - Count a request to send a packet.
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: OutRequests
+ * MIB: IPSTATS_MIB_OUTREQUESTS
+ *
+ */
+probe ipmib.OutRequests=kernel.function("ip_output"),
+			kernel.function("ip_mc_output")
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 1;
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) OutRequests[key] += op;
+}
+
+/**
+ * probe tcpmib.ReasmTimeout
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: ReasmTimeout
+ * MIB: IPSTATS_MIB_REASMTIMEOUT
+ *
+ */
+probe ipmib.ReasmTimeout=kernel.function("icmp_send")
+{
+	skb = $skb_in;
+	op = 0;
+	SourceIsLocal = 1;
+	if(($type==_icmp_time_exceeded())&&($code==_icmp_exc_fragtime())){
+		key = ipmib_filter_key(skb,op,SourceIsLocal);
+		if ( key ) ReasmTimeout[key] += op;
+	}
+}
+
+/**
+ * probe tcpmib.ReasmReqds
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: ReasmReqds
+ * MIB: IPSTATS_MIB_REASMREQDS
+ *
+ */
+probe ipmib.ReasmReqds=kernel.function("ip_defrag")
+{
+	skb = $skb;
+	op = 0;
+	SourceIsLocal = 1;
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) ReasmReqds[key] += op;
+}
+
+/**
+ * probe tcpmib.FragOKs
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: FragOKs
+ * MIB: IPSTATS_MIB_FRAGOKS
+ *
+ */
+probe ipmib.FragOKs=kernel.function("ip_fragment").return
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 1;
+	if ( $return ) next
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) FragOKs [key] += op;
+}
+
+/**
+ * probe tcpmib.FragFails
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: FragFails
+ * MIB: IPSTATS_MIB_FRAGFAILS
+ *
+ */
+probe ipmib.FragFails=kernel.function("ip_fragment").return
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 1;
+	if (!$return ) next
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) FragFails [key] += op;
+}
+
+function _input_route_type:long (skb:long)
+%{ /* pure */
+	struct rtable *rt;
+	struct sk_buff *skb = (struct sk_buff *)(long)THIS->skb;
+	rt = (struct rtable *)kread(&(skb->rtable)); 
+	THIS->__retvalue = kread(&(rt->rt_type));
+	CATCH_DEREF_FAULT();
+%}
+
+function _output_route_type:long (skb:long)
+%{ /* pure */
+	struct rtable *rt;
+	struct dst_entry *dst;
+	struct sk_buff *skb = (struct sk_buff *)(long)THIS->skb;
+	dst = (struct dst_entry *)kread(&(skb->dst));
+	rt = (struct rtable *)dst;
+	THIS->__retvalue = kread(&(rt->rt_type));
+	CATCH_DEREF_FAULT();
+%}
+
+/**
+ * probe tcpmib.InMcastPkts
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: InMcastPkts
+ * MIB: IPSTATS_MIB_INMCASTPKTS
+ *
+ */
+probe ipmib.InMcastPkts=kernel.function("ip_rcv_finish").return
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 0;
+	if ($return == _net_rx_drop()) next;
+	if (_input_route_type(skb) != _rtn_multicast()) next;
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) InMcastPkts[key] += op;
+}
+
+/**
+ * probe tcpmib.OutMcastPkts
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: OutMcastPkts
+ * MIB: IPSTATS_MIB_OUTMCASTPKTS
+ *
+ */
+probe ipmib.OutMcastPkts=kernel.function("ip_finish_output2")
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 1;
+	if (_output_route_type(skb) != _rtn_multicast()) next
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) OutMcastPkts[key] += op;
+}
+
+/**
+ * probe tcpmib.InBcastPkts
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: InBcastPkts
+ * MIB: IPSTATS_MIB_INBCASTPKTS
+ *
+ */
+probe ipmib.InBcastPkts=kernel.function("ip_rcv_finish").return
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 0;
+	if ($return == _net_rx_drop()) next;
+	if (_input_route_type(skb) != _rtn_broadcast()) next;
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) InBcastPkts[key] += op;
+}
+
+/**
+ * probe tcpmib.OutBcastPkts
+ * @skb: Pointer to the struct sk_buff being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: OutBcastPkts
+ * MIB: IPSTATS_MIB_OUTBCASTPKTS
+ *
+ */
+probe ipmib.OutBcastPkts=kernel.function("ip_finish_output2")
+{
+	skb = $skb;
+	op = 1;
+	SourceIsLocal = 1;
+	if (_output_route_type(skb) != _rtn_broadcast()) next
+	key = ipmib_filter_key(skb,op,SourceIsLocal);
+	if ( key ) OutBcastPkts[key] += op;
+}
diff --git a/tapset/linuxmib.stp b/tapset/linuxmib.stp
new file mode 100644
index 00000000..e19755a9
--- /dev/null
+++ b/tapset/linuxmib.stp
@@ -0,0 +1,102 @@
+/*
+ *      Copyright (C) 2009 IBM Corp.
+ *      This file is part of systemtap, and is free software.  You can
+ *      redistribute it and/or modify it under the terms of the GNU General
+ *      Public License (GPL); either version 2, or (at your option) any
+ *      later version.
+ *      
+ *      Version 1.0     wilder@us.ibm.com     2009-07-06
+ */
+
+global DelayedACKs		/* LINUX_MIB_DELAYEDACKS */
+global ListenOverflows		/* LINUX_MIB_LISTENOVERFLOWS */
+global ListenDrops		/* LINUX_MIB_LISTENDROPS */
+global TCPMemoryPressures	/* LINUX_MIB_TCPMEMORYPRESSURES */
+
+/**
+ * probe tcpmib.DelayedACKs - Count of delayed acks.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: DelayedACKs
+ * MIB: LINUX_MIB_DELAYEDACKS
+ *
+ */
+global indelack_timer
+probe linuxmib.DelayedACKs = _linuxmib.DelayedACKs.* {}
+
+probe _linuxmib.DelayedACKs.A = kernel.function("tcp_send_ack")
+{
+	sk=$sk
+	if ( !indelack_timer[sk] ) next
+	op=1
+	key = linuxmib_filter_key(sk,op);
+	if ( key ) DelayedACKs[key] += op;
+}
+
+probe _linuxmib.DelayedACKs.B = kernel.function("tcp_delack_timer")
+{
+	sk=$data
+	indelack_timer[sk]=1
+}
+
+probe _linuxmib.DelayedACKs.C = kernel.function("tcp_delack_timer").return
+{
+	sk=$data
+	indelack_timer[sk]=0;
+}
+
+/**
+ * probe tcpmib.ListenOverflows - Count of times a listen queue overflowed
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: ListenOverflows
+ * MIB: LINUX_MIB_LISTENOVERFLOWS
+ *
+ */
+probe linuxmib.ListenOverflows=kernel.function("tcp_v4_syn_recv_sock").return
+{
+	sk = $sk
+	if ( $return ) next
+	if ( $sk->sk_ack_backlog <= $sk->sk_max_ack_backlog ) next
+	op = 1;
+	key = linuxmib_filter_key(sk,op);
+	if ( key ) ListenOverflows[key] += op;
+}
+
+/**
+ * probe tcpmib.ListenDrops - Count of times conn request that were dropped.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: ListenDrops
+ * MIB: LINUX_MIB_LISTENDROPS
+ *
+ */
+probe linuxmib.ListenDrops=kernel.function("tcp_v4_syn_recv_sock").return
+{
+	sk = $sk
+	if ( $return ) next
+	op = 1;
+	key = linuxmib_filter_key(sk,op);
+	if ( key ) ListenDrops[key] += op;
+}
+
+/**
+ * probe tcpmib.TCPMemoryPressures - Count of times memory pressure was used.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: TCPMemoryPressures
+ * MIB: LINUX_MIB_TCPMEMORYPRESSURES
+ *
+ */
+probe linuxmib.TCPMemoryPressures=kernel.function("tcp_enter_memory_pressure")
+{
+	sk = $sk
+	op = 1;
+	if ( $tcp_memory_pressure ) next
+	key = linuxmib_filter_key(sk,op);
+        if ( key ) TCPMemoryPressures[key] += op;
+}
diff --git a/tapset/tcpmib.stp b/tapset/tcpmib.stp
new file mode 100644
index 00000000..e3e76900
--- /dev/null
+++ b/tapset/tcpmib.stp
@@ -0,0 +1,352 @@
+/*
+ *      Copyright (C) 2009 IBM Corp.
+ *      This file is part of systemtap, and is free software.  You can
+ *      redistribute it and/or modify it under the terms of the GNU General
+ *      Public License (GPL); either version 2, or (at your option) any
+ *      later version.
+ *      
+ *      Version 1.0     wilder@us.ibm.com     2009-07-06
+ */
+
+/* Global counter definitions for mib TCP_MIB. */
+
+%{
+#include <net/sock.h>
+#include <linux/tcp.h>
+#include <net/tcp_states.h>
+#include <linux/skbuff.h>
+#include <net/route.h>
+%}
+
+global ActiveOpens
+global AttemptFails
+global CurrEstab
+global EstabResets
+// global InErrs, this mib is not yet supported
+global InSegs
+global OutRsts
+global OutSegs
+global PassiveOpens
+global RetransSegs
+
+/**
+ * sfunction tcpmib_get_state - Get a socket's state.
+ *
+ * Returns the sk_state from a struct sock.
+ * @sk: Pointer to a struct sock.
+ *
+ */
+function tcpmib_get_state:long (sk:long)
+%{ /* pure */
+	struct sock *sk = (struct sock *)(long)THIS->sk;
+	THIS->__retvalue = kread(&(sk->sk_state));
+	CATCH_DEREF_FAULT();
+%}
+
+/**
+ * sfunction tcpmib_local_addr - Get the source address.
+ *
+ * Returns the saddr from a struct inet_sock.
+ * @sk: Pointer to a struct inet_sock.
+ *
+ */
+function tcpmib_local_addr:long(sk:long)
+%{ /* pure */
+        struct inet_sock *inet = (struct inet_sock *) (long) THIS->sk;
+        THIS->__retvalue = ntohl(kread(&(inet->saddr)));
+        CATCH_DEREF_FAULT();
+%}
+
+/**
+ * sfunction tcpmib_remote_addr - Get the remote address.
+ *
+ * Returns the daddr from a struct inet_sock.
+ * @sk: Pointer to a struct inet_sock.
+ *
+ */
+function tcpmib_remote_addr:long(sk:long)
+%{ /* pure */
+        struct inet_sock *inet = (struct inet_sock *) (long) THIS->sk;
+        THIS->__retvalue = ntohl(kread(&(inet->daddr)));
+        CATCH_DEREF_FAULT();
+%}
+
+/**
+ * sfunction tcpmib_local_port - Get the local port.
+ *
+ * Returns the sport from a struct inet_sock.
+ * @sk: Pointer to a struct inet_sock.
+ *
+ */
+function tcpmib_local_port:long(sk:long)
+%{ /* pure */
+        struct inet_sock *inet = (struct inet_sock *) (long) THIS->sk;
+        THIS->__retvalue = ntohs(kread(&(inet->sport)));
+        CATCH_DEREF_FAULT();
+%}
+
+/**
+ * sfunction tcpmib_remote_port - Get the remote port.
+ *
+ * Returns the dport from a struct inet_sock.
+ * @sk: Pointer to a struct inet_sock.
+ *
+ */
+function tcpmib_remote_port:long(sk:long)
+%{ /* pure */
+        struct inet_sock *inet = (struct inet_sock *) (long) THIS->sk;
+        THIS->__retvalue = ntohs(kread(&(inet->dport)));
+        CATCH_DEREF_FAULT();
+%}
+
+/**
+ * probe tcpmib.ActiveOpens - Count an active opening of a socket.
+ * @sk:	Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: ActiveOpens
+ * MIB: TCP_MIB_ACTIVEOPENS
+ *
+ */
+probe
+tcpmib.ActiveOpens=kernel.function("tcp_connect").return
+{
+	sk = $sk;
+	op = 1;
+	if ( $return ) next;
+	key = tcpmib_filter_key(sk,op);
+	if ( key ) ActiveOpens[key] += op;
+}
+
+/**
+ * probe tcpmib.AttemptFails - Count a failed attempt to open a socket.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: AttemptFails
+ * MIB: TCP_MIB_ATTEMPTFAILS
+ *
+ */
+probe
+tcpmib.AttemptFails=kernel.function("tcp_done")
+{
+	sk = $sk;
+	state = tcpmib_get_state(sk);
+	op = 1;
+
+	TCP_SYN_SENT = 2;
+	TCP_SYN_RECV = 3;
+	if( state == TCP_SYN_SENT || state == TCP_SYN_RECV){
+		key = tcpmib_filter_key(sk,op);
+		if ( key ) AttemptFails[key] += op;
+	}
+}
+
+/**
+ * probe tcpmib.CurrEstab - Update the count of open sockets.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: CurrEstab
+ * MIB: TCP_MIB_CURRESTAB
+ *
+ */
+probe
+tcpmib.CurrEstab=kernel.function("tcp_set_state")
+{
+	sk = $sk;
+	state = $state;
+	oldstate = tcpmib_get_state(sk);
+
+	TCP_ESTABLISHED = 1;
+	if ( oldstate == TCP_ESTABLISHED ) {
+		op = -1;
+		key = tcpmib_filter_key(sk,op);
+		if ( key ) CurrEstab[key] += op;
+	} else {
+		if ( state == TCP_ESTABLISHED ) {
+			op = 1;
+			key = tcpmib_filter_key(sk,op);
+			if ( key ) CurrEstab[key] += op;
+		}
+	}
+}
+
+/**
+ * probe tcpmib.EstabResets - Count the reset of a socket.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: EstabResets
+ * MIB: TCP_MIB_ESTABRESETS
+ *
+ */
+probe
+tcpmib.EstabResets=kernel.function("tcp_set_state")
+{
+	sk = $sk;
+        state = $state;
+        oldstate = tcpmib_get_state(sk);
+	op = 1;
+
+	TCP_CLOSE = 7;
+	TCP_CLOSE_WAIT = 8;
+	TCP_ESTABLISHED = 1;
+	if ( ( state == TCP_CLOSE ) && 
+	   (oldstate == TCP_CLOSE_WAIT || oldstate == TCP_ESTABLISHED) ){
+        	key = tcpmib_filter_key(sk,op);
+		if ( key ) EstabResets[key] += op;
+	}
+}
+
+/**
+ * probe tcpmib.InSegs - Count an incomming tcp segment.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: InSegs
+ * MIB: TCP_MIB_INSEGS
+ *
+ */
+probe
+tcpmib.InSegs=kernel.function("__inet_lookup_established").return
+{
+        sk=$return
+	op=1
+	key = tcpmib_filter_key(sk,op);
+	if ( key ) InSegs[key] += op;
+}
+
+/**
+ * probe tcpmib.OutRsts - Count the sending of a reset packet.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: OutRsts
+ * MIB: TCP_MIB_OUTRSTS
+ *
+ */
+probe
+tcpmib.OutRsts = 	tcpmib.OutRsts.A,
+			tcpmib.OutRsts.B { }
+
+function _rtn_local:long ()
+%{
+        THIS->__retvalue = RTN_LOCAL;
+%}
+
+function _is_reset:long (skb:long)
+%{ /* pure */
+        struct tcphdr *th;
+        struct sk_buff *skb = (struct sk_buff *)(long)THIS->skb;
+
+	#ifdef NET_SKBUFF_DATA_USES_OFFSET
+		th = (struct tcphdr *)(kread(&(skb->network_header)) + kread(&(skb->head)));
+	#else
+		th = (struct tcphdr *)kread(&(skb->network_header));
+	#endif
+        THIS->__retvalue = th->rst;
+        CATCH_DEREF_FAULT();
+%}
+
+function _tcpmib_input_route_type:long (skb:long)
+%{ /* pure */
+        struct rtable *rt;
+        struct sk_buff *skb = (struct sk_buff *)(long)THIS->skb;
+        rt = (struct rtable *)kread(&(skb->rtable));
+        THIS->__retvalue = kread(&(rt->rt_type));
+        CATCH_DEREF_FAULT();
+%}
+
+/*
+ * note:
+ * tcp_v4_send_reset may be called with a NULL sk.
+ * This happens when sending a reset in response to a syn 
+ * when no socket exists (for example the service is not running).
+ * Without a socket we can't count the reset.
+ */
+probe
+tcpmib.OutRsts.A=kernel.function("tcp_v4_send_reset")
+{
+        sk = $sk;
+        skb = $skb
+        op = 1;
+        if ( _is_reset(skb) ) next
+        if (_tcpmib_input_route_type($skb) != _rtn_local() )
+                next;
+        key = tcpmib_filter_key(sk,op);
+        if ( key ) OutRsts[key] += op;
+}
+
+probe
+tcpmib.OutRsts.B= kernel.function("tcp_send_active_reset")
+{
+	/* Almost correct,
+	 * If alloc_skb() fails it incorrectly bumps TCP_MIB_OUTRSTS,
+	 */
+	sk = $sk;
+	op = 1;
+	key = tcpmib_filter_key(sk,op);
+        if ( key ) OutRsts[key] += op;
+}
+
+/**
+ * probe tcpmib.OutSegs - Count the sending of a TCP segment.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: OutSegs
+ * MIB: TCP_MIB_OUTSEGS
+ *
+ */
+probe
+tcpmib.OutSegs=kernel.function("ip_queue_xmit").return
+{
+	if ( $return < 0 ) next;
+	sk = $skb->sk;
+	op = 1;
+	
+        //  Only count the events with protocol IPPROTO_TCP,6.
+	iphdr = __get_skb_iphdr($skb);
+        if( !(__ip_skb_proto(iphdr) == 6) ) next ;
+	key = tcpmib_filter_key(sk,op);
+	if ( key ) OutSegs[key] += op;
+}
+
+/**
+ * probe tcpmib.PassiveOpens - Count the passive creation of a socket.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: PassiveOpens
+ * MIB: TCP_MIB_PASSIVEOPENS
+ *
+ */
+probe
+tcpmib.PassiveOpens=kernel.function("tcp_v4_syn_recv_sock").return
+{
+        sk = $return;
+        op = 1;
+        if ( !sk ) next;
+        key = tcpmib_filter_key(sk,op);
+        if ( key ) PassiveOpens[key] += op;
+}
+
+/**
+ * probe tcpmib.RetransSegs - Count the retransmission of a TCP segment.
+ * @sk: Pointer to the struct sock being acted on.
+ * @op: Value to be added to the counter (Operation). 
+ *
+ * Counter Name: RetransSegs
+ * MIB: TCP_MIB_RETRANSSEGS
+ *
+ */
+probe
+tcpmib.RetransSegs=kernel.function("tcp_retransmit_skb").return
+{
+	sk = $sk;
+	op = 1;
+	if ( $return ) next;
+	key = tcpmib_filter_key(sk,op);
+	if ( key ) RetransSegs[key] += op;
+}
diff --git a/testsuite/buildok/ipmib-all-probes.stp b/testsuite/buildok/ipmib-all-probes.stp
new file mode 100644
index 00000000..b6bedcf7
--- /dev/null
+++ b/testsuite/buildok/ipmib-all-probes.stp
@@ -0,0 +1,15 @@
+#! stap -p4
+
+// Tests if all probes in the ipmib tapset are resolvable.
+
+probe ipmib.* {}
+
+function ipmib_filter_key:long (skb:long, op:long, SourceIsLocal:long) {
+	// Insure all these functions will build
+	if ( ipmib_remote_addr(skb, SourceIsLocal) ) return 0
+	if ( ipmib_local_addr(skb, SourceIsLocal) ) return 0
+	if ( ipmib_tcp_remote_port(skb, SourceIsLocal) ) return 0
+	if ( ipmib_tcp_local_port(skb, SourceIsLocal) ) return 0
+	if ( ipmib_get_proto(skb) ) return 0
+	return op
+}
diff --git a/testsuite/buildok/linuxmib-all-probes.stp b/testsuite/buildok/linuxmib-all-probes.stp
new file mode 100644
index 00000000..c79fc7d3
--- /dev/null
+++ b/testsuite/buildok/linuxmib-all-probes.stp
@@ -0,0 +1,9 @@
+#! stap -p4
+
+// Tests if all probes in the linuxmib tapset are resolvable.
+
+probe linuxmib.* {}
+
+function linuxmib_filter_key:long (sk:long, op:long) {
+	return 0
+}
diff --git a/testsuite/buildok/tcpmib-all-probes.stp b/testsuite/buildok/tcpmib-all-probes.stp
new file mode 100644
index 00000000..f20ba8bb
--- /dev/null
+++ b/testsuite/buildok/tcpmib-all-probes.stp
@@ -0,0 +1,15 @@
+#! stap -p4
+
+// Tests if all probes in the tcpmib tapset are resolvable.
+
+probe tcpmib.* {}
+
+function tcpmib_filter_key:long (sk:long, op:long) {
+	// Insure all these functions will build
+	if ( tcpmib_get_state(sk) ) return 0
+	if ( tcpmib_local_addr(sk) ) return 0
+	if ( tcpmib_remote_addr(sk) ) return 0
+	if ( tcpmib_local_port(sk) ) return 0
+	if ( tcpmib_remote_port(sk) ) return 0
+	return op
+}
diff --git a/testsuite/systemtap.examples/network/tcpipstat.meta b/testsuite/systemtap.examples/network/tcpipstat.meta
new file mode 100644
index 00000000..d77d0b2f
--- /dev/null
+++ b/testsuite/systemtap.examples/network/tcpipstat.meta
@@ -0,0 +1,14 @@
+title: Display network statistics for individual TCP sockets.
+name: tcpipstat.stp
+version: 1.0
+author: wilder@us.ibm.com
+keywords: network statistics
+subsystem: network
+status: production
+exit: user-controlled
+output: timed
+scope: per-socket
+arg_[0-9]+: tcpstat.stp [index=laddr|raddr|lport|rport|tuple] [timeout=<N sec>] [nozeros=1|0] [filters...]
+description: tcpipstat collects and display network statistics related to individual TCP sockets or groups of sockets.  The statistics that are collected are simmer to that of the command netstat -s, only sorted and grouped by individual sockets.
+test_check: stap -p4 tcpipstat.stp
+test_installcheck: stap tcpipstat.stp timeout=1
diff --git a/testsuite/systemtap.examples/network/tcpipstat.stp b/testsuite/systemtap.examples/network/tcpipstat.stp
new file mode 100644
index 00000000..23f0e7cd
--- /dev/null
+++ b/testsuite/systemtap.examples/network/tcpipstat.stp
@@ -0,0 +1,610 @@
+#! /usr/bin/env stap
+/*
+ *      Copyright (C) 2009 IBM Corp.
+ *      This file is part of systemtap, and is free software.  You can
+ *      redistribute it and/or modify it under the terms of the GNU General
+ *      Public License (GPL); either version 2, or (at your option) any
+ *      later version.
+ *      
+ *      Version 1.0     wilder@us.ibm.com     2009-07-06
+ *
+ *	Name:
+ *	tcpipstat.stp - Per-socket tcpip statistics collection facility.
+ *	(netstat -s on steroids)
+ *
+ *	Description:
+ *	The purpose of tcpipstat is to collect and display network statistics
+ *	related to individual TCP sockets or groups of sockets.  The statistics
+ *	that are collected are simmer to that of the command netstat -s, only
+ *	sorted and grouped by individual sockets.  The statistics collected are
+ *	based on the SNMP TCP and IP MIBS. As the name implies this command
+ *	collects data relating to TCP sockets, not UDP sockets. I plan to
+ *	support a UDP tool in a later version. The tcpipstat tool uses
+ *	systemtap to collect data from the linux kernel; see the stap command
+ *	manual page for instructions and options available in systemtap. For
+ *	more information on the systemtap project see:
+ *	http://sourceware.org/systemtap/documentation.html
+ *
+ *
+ *	Synopsis:
+ *	tcpstat.stp 	[index=laddr|raddr|lport|rport|tuple]\
+ *			[timeout=<N sec>]\
+ *			[nozeros=1|0]\
+ *			[filters...]
+ *	
+ *	index	(optional) tcpipstat collects, sorts and displays network
+ *		statistics into buckets. The buckets are indexed based on
+ *		one of several index types.  By default the index is
+ *		constructed from all four elements of the socket tuple,
+ *		providing a separate bucket for each socket.  However, any
+ *		individual element of the tuple can be used as the index.
+ *		Valid values for index are laddr (local address), raddr
+ *		(remote address) , lport, rport or tuple.  For example if
+ *		index=lport is specified network statistics will be collected
+ *		and reported based on the value of the local port thus
+ *		providing statistics related to each network service provided
+ *		by the system.
+ *
+ *	timeout (optional) When a timeout value (in seconds) is specified
+ *		tcpstat will automatically terminate it's run at the end of
+ *		the specified time and produce a report. When timeout is
+ *		omitted the script will run until the user terminates it by
+ *		typing a ^c.
+ *
+ *	onclose (optional) In onclose mode (onclose=1) statistics are reported
+ *		 only when a socket closes.  The generated report reflect
+ *		 statistics for the entire life on the socket, assuming
+ *		 tcpipstat was running at the time the socket was opened.
+ *		 The option index=tuple must be set for onclode to work 
+ *		(index=tuple is default).
+ *
+ *	nozeros (optional) When nonzero=1 is specified statistics with
+ *		a value of zero will not be printed.
+ *
+ *	filters	(optional) By default statistics are counted for every socket
+ *		on the system.  Address filters can be used to limit what
+ *		sockets data is collected for.  All filters are 
+ *		pass-through filters.  Multiple filters may be given separated
+ *		by a space.  When multiple filters are given an event only
+ *		needs to be accepted by one filter to be counted.  A wild-card
+ *		(*) value can be used for any component of the filter.        
+ *
+ *		The format of a filter is:
+ *		<local-address>:<local-port>-<remote address>:<remote-port>
+ *
+ *		Addresses are specified as ipv4 dot notation address. Ports
+ *		are specified as decimal numbers.  A "*" character can be used
+ *		in any field to indicate a wild-card value.  If no filters are
+ *		given the following wild-card filter is automatically used:
+ *		*.*.*.*:*-*.*.*.*:*
+ *
+ *	Known Bugs:
+ *		Not all MIB values are currently supported.
+ *		Ipv6 in not yet supported.
+ *
+ *	Examples:
+ *		Here are some ways that tcpipstat could be used.
+ *		
+ *		List per-socket statistics for every active socket for the
+ *		next 60 seconds.
+ *		$ tcpipstat timeout=60
+ *
+ *		Who is talking to my webserver?
+ *		$ tcpipstat.stp index=raddr *.*.*.*:80-*.*.*.*:*
+ *
+ *		What services (on this system) is host 192.168.1.103 using
+ *		$ tcpipstat.stp index=rport *.*.*.*:*-192.168.1.103:*
+ *
+ *		What hosts in the 9.0.0.0 network is this system communicating
+ *		with?
+ *		$ tcpipstat.stp index=raddr *.*.*.*:*-9.*.*.*:*
+ *
+ *		What ports are people connecting to? or which services are busy?
+ *		$ tcpipstat.stp index=lport
+ *
+ *		Show network statistics related to a single run of netperf.
+ *		$ stap -c netperf -H <server-ip>\
+ *			  tcpipstat.stp *.*.*.*:*-<server-ip>:*
+ *
+ */
+
+global filter;
+global number_of_filters;
+
+global key_list;
+global lastkey;
+
+// Command arguments and default values
+global index= "tuple";
+global timeout = -1;
+global nozeros = 1;
+global onclose = 0;
+
+probe begin {
+
+	number_of_filters=process_cmdline()
+
+	if ( 	index != "laddr" &&
+		index != "raddr" &&
+		index != "lport" &&
+		index != "rport" &&
+		index != "tuple" ) usage("Invalid index value!");
+
+	if ( onclose && (index!="tuple") )
+		 usage("onclose must be used with index=tuple!");
+
+	/* The user did not supply a filter, build a wild-card filter */
+	if ( number_of_filters == 0 ){
+		number_of_filters++;
+                j=6;
+		filter[j]   = ipv4_pton("*.*.*.*",0)
+		filter[j+1] = ipv4_pton("*.*.*.*",1)
+		filter[j+2] = ipv4_portton("*")
+		filter[j+3] = ipv4_pton("*.*.*.*",0)
+		filter[j+4] = ipv4_pton("*.*.*.*",1)
+		filter[j+5] = ipv4_portton("*")
+	}
+
+	if ( number_of_filters < 0 ){
+		usage("Bad filter format!");
+	}
+
+	printf("Indexing collected stats using %s values\n",index);
+	for (i=1; i <= number_of_filters; i++){
+		print_filter(i);
+	}
+}
+
+/* All command line arguments other than the filters are processed
+ * first and must be placed on the command line prior to any filters.
+ */
+function process_cmdline:long ()
+{
+	filter_number=0;
+	for (i=1; i <= argc; i++){
+		argument= tokenize(argv[i], "=")
+
+		if ( argument == "index" ){
+			argv[i]=""
+			index=tokenize(argv[i], "=")
+			continue;
+		}
+
+		if ( argument == "timeout" ){
+			argv[i]=""
+			timeout=strtol(tokenize(argv[i], "="),10)
+			continue;
+		}
+
+		if ( argument == "nozeros" ){
+			argv[i]=""
+			nozeros=strtol(tokenize(argv[i], "="),10)
+			continue;
+		}
+
+		if ( argument == "onclose" ){
+			argv[i]=""
+			onclose=strtol(tokenize(argv[i], "="),10)
+			continue;
+		}
+
+		/* Example: adding more option flags 
+		if ( argument == "stuff" ){
+			argv[i]=""
+			stuff=tokenize(argv[i], "=")
+			continue;
+		}
+                */
+
+		/* Anything on the command line after this point must
+ 		 * be a filter.
+ 		 */
+		local = tokenize(argv[i], "-")
+			argv[i] = ""
+		remote = tokenize(argv[i], "-")
+
+		local_addr = tokenize(local, ":")
+			local=""
+		local_port = tokenize(local, ":")
+
+		remote_addr = tokenize(remote, ":")
+			remote=""
+		remote_port = tokenize(remote, ":")
+
+		/* stap bug */
+		if ( remote_port == "fobar") i=i;
+
+		++filter_number;
+		j=filter_number*6;
+		filter[j]   = ipv4_pton(local_addr,0)	// Local address
+		filter[j+1] = ipv4_pton(local_addr,1)	// Local address mask
+		filter[j+2] = ipv4_portton(local_port)	// Local port
+		filter[j+3] = ipv4_pton(remote_addr,0)	// Remote address
+		filter[j+4] = ipv4_pton(remote_addr,1)	// Remote address mask
+		filter[j+5] = ipv4_portton(remote_port)	// Remote port
+
+		if (filter[j]< -1 ||
+			filter[j+1] < -1 ||
+			filter[j+2] < -1 ||
+			filter[j+3] < -1 ||
+			filter[j+4] < -1 ||
+			filter[j+5] < -1 ) return -1;
+		}
+		return filter_number;
+}
+
+/* 
+ * Convert an ascii integer values between 0 and 65534 to a u16 port number.
+ * "*" are treated as wildcards and will be converted to 0xffff (65535).
+ */
+function ipv4_portton:long (port:string)
+{
+	if ( port == "*" ) port="65535";
+	pport=strtol(port,10);
+	if ( pport > 0xffff ){
+		printf("Bad port number %s\n",port)
+		return -22;
+	}
+	return pport
+}
+
+/*
+ * Convert an ipv4 dot notation address into longs.
+ * Supports "*" in any field treating it as a wildcard by making the byte=0.
+ * If make_mask is set, it creates a mask based on the "*" fields. All non='*'
+ * bytes are set to 0xff all * fields are set to 0x0;.
+ */
+function ipv4_pton:long (addr:string, make_mask:long)
+{
+	i=32;
+	ip=0;
+	ips=addr;
+	while(strlen(byte = tokenize(ips, ".")) != 0) {
+		i-=8;
+		ips="";
+
+		if ( byte == "*" ){
+			 byte = "0"
+		} else {
+			 if ( make_mask ) byte = "255";
+		}
+
+		j=strtol(byte,10);
+		if ( j > 255 ){
+			printf("bad address %s\n",addr)
+			return -22;
+		}
+		ip=ip+(j<<i) // left shift the byte into the address
+	}
+	if ( i != 0 ){
+		printf("bad address %s\n",addr)
+		return -22;
+	}
+	return ip;
+}
+
+function usage (msg:string)
+{
+	printf("\nUsage:\n");
+	printf("\ttcpipstat.stp\t[index=laddr|raddr|lport|rport|tuple]\n");
+	printf("\t\t\t[timeout=<sec>] [nozeros=0|1] [onclose=0|1]\n");
+	printf("\t\t\t[filter ......]\n\n");
+	printf("\tfilter format:\n");
+	printf("\t<local ip-address>:<local-port>-<remote ip-address>:<remote-port>\n\n");
+	error(msg);
+}
+
+/* Print filter number n. This is helpful for debugging */
+function print_filter (n:long)
+{
+	j=n*6;
+	printf("Processed filter #%d = %s[0x%x]:%d --> %s[0x%x]:%d \n",
+		n,ip_ntop(htonl(filter[j])), filter[j+1], filter[j+2],
+		ip_ntop(htonl(filter[j+3])), filter[j+4], filter[j+5]);
+}
+
+/* 
+ * Returns a unique value (stored in the global key_list) based on the socket
+ * address tuple and the global collection index value. A new value is created 
+ * if one does not already exist.
+ */
+function build_key:long (laddr:long, raddr:long, lport:long, rport:long)
+{
+	if ( index == "laddr" ) raddr = lport = rport = 0
+	if ( index == "raddr" ) laddr = lport = rport = 0
+	if ( index == "lport" ) laddr = raddr = rport = 0
+	if ( index == "rport" ) laddr = raddr = lport = 0
+
+	if ( key_list[laddr, raddr, lport, rport] )
+                return  key_list[laddr, raddr, lport, rport]
+        else
+                return key_list[laddr, raddr, lport, rport] = ++lastkey
+}
+
+/*
+ * This is where the real work of the probe filtering is done.
+ * Important: this function is run for every probe hit so
+ * keep it small and fast!
+ *
+ * If the probe passes through the filters a "key" value is
+ * returned otherwise it returns zero.
+ */
+function filter_key:long (laddr:long, raddr:long, lport:long, rport:long)
+{
+       for (i=1; i <= number_of_filters; i++){
+                j=i*6;
+
+		/*
+		printf("\n %s\n",pp())
+                print_filter(i);
+                printf("local=0x%x:0x%x remote=0x%x:0x%x  ",
+                      laddr, lport, raddr, rport);
+		*/
+
+		// Local filter
+		local_filter=remote_filter=0;
+		if ( (laddr&filter[j+1]) == filter[j] ) {
+			if ( (filter[j+2] == 0xffff) || (lport == filter[j+2])) 
+				local_filter = 1;
+		}
+		// Remote filter
+		if ( (raddr&filter[j+4]) == filter[j+3] ) {
+			if ( (filter[j+5] == 0xffff) || (rport == filter[j+5]))
+				remote_filter = 1;
+		}
+
+		// printf("local=%d remote=%d  ",local_filter,remote_filter);
+
+		if(local_filter && remote_filter){
+                        // key = build_key(laddr, raddr, lport, rport);
+                        // printf("|Collected: key=%d\n",key);
+                        // return key;
+			return build_key(laddr, raddr, lport, rport);
+		}
+	}
+	// printf("\n");
+	return 0;
+}
+
+/* This function is called by every ipmib probe handler.
+ * Returns a "key" value to be used as an index into the collection arrays.
+ */
+function ipmib_filter_key:long (skb:long, op:long, SourceIsLocal:long)
+{
+	if ( !skb ) return 0;
+	// We only care about events with protocol IPPROTO_TCP(=6)
+	if( !(ipmib_get_proto(skb) == 6) ) return 0;
+	raddr = ipmib_remote_addr(skb, SourceIsLocal);
+	laddr = ipmib_local_addr(skb, SourceIsLocal);
+	rport = ipmib_tcp_remote_port(skb, SourceIsLocal);
+	lport = ipmib_tcp_local_port(skb, SourceIsLocal);
+
+	return filter_key(laddr, raddr, lport, rport);
+}
+
+/* This function is called by every tcpmib probe handler. 
+ * Returns a "key" value to be used as an index into the collection arrays.
+ */
+function tcpmib_filter_key:long (sk:long, op:long)
+{
+        if ( !sk ) return 0;
+        laddr = tcpmib_local_addr(sk);
+        raddr = tcpmib_remote_addr(sk);
+        lport = tcpmib_local_port(sk);
+        rport = tcpmib_remote_port(sk);
+        return filter_key(laddr, raddr, lport, rport);
+}
+
+/* This function is called by every linuxmib probe handler. 
+ * Returns a "key" value to be used as an index into the collection arrays.
+ * For now this is just the same as the tcpmib_filter_key.
+ */
+function linuxmib_filter_key:long (sk:long, op:long)
+{
+        return tcpmib_filter_key(sk,op);
+}
+
+function print_sockmib (key:long)
+{
+	printf("Socket:\n");
+	if (SockSendbytes[key]||!nozeros)
+		printf("\tBytes Sent = %d\n", SockSendbytes[key]);
+	if (SockSendmsg[key]||!nozeros)
+		printf("\tMessages sent = %d\n", SockSendmsg[key]);
+	if (SockRecvbytes[key]||!nozeros)
+		printf("\tBytes Received = %d\n", SockRecvbytes[key]);
+	if (SockRecvmsg[key]||!nozeros)
+		printf("\tMessages Received = %d\n", SockRecvmsg[key]);
+}
+
+
+/*
+ * Prints the collected values for the IP mib.
+ */
+function print_ipmib (key:long)
+{
+	printf("Ip:\n");
+	if (InReceives[key]||!nozeros)
+		printf("\tInReceives = %d\n", InReceives[key]);
+	if (OutRequests[key]||!nozeros) 
+		printf("\tOutRequests = %d\n", OutRequests[key]);
+	if (ReasmTimeout[key]||!nozeros) 
+		printf("\tReasmTimeout = %d\n", ReasmTimeout[key]);
+	if (ReasmReqds[key]||!nozeros) 
+		printf("\tReasmReqds = %d\n", ReasmReqds[key]);
+	if (FragOKs[key]||!nozeros) 
+		printf("\tFragOKs = %d\n", FragOKs[key]);
+	if (FragFails[key]||!nozeros) 
+		printf("\tFragFails = %d\n", FragFails[key]);
+}
+
+/*
+ * Prints the collected values for the TCP mib.
+ */
+function print_tcpmib (key:long)
+{
+	printf("Tcp:\n");
+	if (ActiveOpens[key]||!nozeros)
+		printf("\tActiveOpens = %d\n", ActiveOpens[key]);
+	if (AttemptFails[key]||!nozeros)
+		printf("\tAttemptFails = %d\n", AttemptFails[key]);
+	if (CurrEstab[key]||!nozeros)
+		printf("\tCurrEstab = %d\n", CurrEstab[key]);
+	if (EstabResets[key]||!nozeros)
+		printf("\tEstabResets = %d\n", EstabResets[key]);
+//	if (InErrs[key]||!nozeros) 
+//		printf("\tInErrs = %d\n", InErrs[key]);
+	if (InSegs[key]||!nozeros)
+		printf("\tInSegs = %d\n", InSegs[key]);
+	if (OutRsts[key]||!nozeros)
+		printf("\tOutRsts = %d\n", OutRsts[key]);
+	if (OutSegs[key]||!nozeros)
+		printf("\tOutSegs = %d\n", OutSegs[key]);
+	if (PassiveOpens[key]||!nozeros)
+		printf("\tPassiveOpens = %d\n", PassiveOpens[key]);
+	if (RetransSegs[key]||!nozeros) 
+		printf("\tRetransSegs = %d\n", RetransSegs[key]);
+}
+
+/*
+ * Prints the collected values for the linux mib.
+ */
+function print_linuxmib (key:long)
+{
+        printf("TcpExt:\n");
+	if (DelayedACKs[key]||!nozeros)
+		printf("\tdelayed acks sent = %d\n", DelayedACKs[key]);
+	if (ListenOverflows[key]||!nozeros)
+		printf("\ttimes the listen queue of a socket overflowed = %d\n", ListenOverflows[key]);
+	if (ListenDrops[key]||!nozeros)
+		printf("\tSYNs to LISTEN sockets ignored = %d\n", ListenDrops[key]);
+	if (TCPMemoryPressures[key]||!nozeros)
+		printf("\ttcp memory pressure = %d\n", TCPMemoryPressures[key]);
+}
+
+function report ()
+{
+	number_of_keys=0
+
+	foreach ([laddr, raddr, lport, rport] in key_list) {
+		++number_of_keys;
+		_report(laddr, raddr, lport, rport);
+	}
+	if ( !number_of_keys )
+		printf("\nNo packets were accepted by the filters.\n");
+}
+
+
+function _report(laddr:long, raddr:long, lport:long, rport:long)
+{
+	printf("\n-----------------------------------------\n");
+	if ( laddr && raddr && lport && rport ) // index=tuple
+		 printf("%s:%d <-> %s:%d\n",
+			ip_ntop(htonl(laddr)), lport,
+			ip_ntop(htonl(raddr)), rport)
+	else { 
+		if ( laddr )
+			printf("Local address: %s\n",ip_ntop(htonl(laddr)));
+		if ( raddr )
+			printf("Remote address: %s\n",ip_ntop(htonl(raddr)));
+		if ( lport )
+			printf("Local port: %d\n",lport);
+		if ( rport )
+			printf("Remote port: %d\n",rport);
+	}
+
+	key = key_list[laddr, raddr, lport, rport]
+	if ( onclose && (CurrEstab[key] < 0) )
+		printf("Stats were not collected for the entire socket life.\n")
+	printf("-----------------------------------------\n");
+		
+	print_sockmib(key)
+	print_ipmib(key)
+	print_tcpmib(key)
+	print_linuxmib(key)
+	printf("\n\n")
+}
+
+/* Terminates the run in timeout seconds, using global timeout value */
+probe timer.s(1) {
+	if ( timeout == -1 ) next
+	if ( !timeout-- ) exit()
+}
+
+/* We are done, print a report and exit. */
+probe end {
+	if ( !onclose )
+		report()
+}
+
+/* Enable the probes for the statictics we want to count.
+ *
+ * The impact of running this script on your system can
+ * be reduced by enabling only the probes corresponding to the
+ * statictics you are interested in.  For example, if all you care about
+ * is counting the number of incomming connections that are established use:
+ * "probe tcpmib.PassiveOpens {}"
+ */
+
+/* Collect all tcpmib stats */
+probe tcpmib.* {}
+
+/* Collect all ip stats */
+probe ipmib.* {}
+
+/* Collect the extended linux stats */
+probe linuxmib.* {}
+
+/* This probe supports the onclose option.  When a connection closes
+ * CurrEstab will return an op of -1, we use that condition to trigger
+ * the dump off all stats for this socket. This feature only makes sense
+ * when index=tuple. 
+ */
+probe tcpmib.CurrEstab
+{
+	if (!onclose) next
+	if (!key) next
+	if ( op != -1 ) next;
+	if ( !sk ) next;
+
+        laddr = tcpmib_local_addr(sk);
+        raddr = tcpmib_remote_addr(sk);
+        lport = tcpmib_local_port(sk);
+        rport = tcpmib_remote_port(sk);
+
+	_report(laddr, raddr, lport, rport)
+	delete key_list[laddr, raddr, lport, rport]
+	delete CurrEstab[key]
+}
+	
+
+/* SNMP has no counter for the number of bytes sent or received by TCP.
+ * The next two probes give us these raw byte counts.
+ */
+global SockSendbytes;
+global SockSendmsg;
+probe tcp.sendmsg.return {
+        sk = $sock->sk;
+        op = size; // $return
+	if ( op <= 0 ) next;
+        if ( !sk ) next;
+        key = tcpmib_filter_key(sk,op);
+        if ( key ) {
+		SockSendbytes[key] += op;
+		++SockSendmsg[key];
+	}
+}
+
+global SockRecvbytes;
+global SockRecvmsg;
+probe tcp.recvmsg.return{
+	sk = $sk
+	op = size // $return
+	if ( op <= 0 ) next;
+        if ( !sk ) next;
+        key = tcpmib_filter_key(sk,op);
+        if ( key ) {
+		SockRecvbytes[key] += op;
+		++SockRecvmsg[key];
+	}
+}
diff --git a/testsuite/systemtap.examples/network/tcpipstat.txt b/testsuite/systemtap.examples/network/tcpipstat.txt
new file mode 100644
index 00000000..100bbb78
--- /dev/null
+++ b/testsuite/systemtap.examples/network/tcpipstat.txt
@@ -0,0 +1,35 @@
+$ ./tcpipstat.stp nozeros=0
+Indexing collected stats using tuple values
+Processed filter #1 = 0.0.0.0[0x0]:65535 --> 0.0.0.0[0x0]:65535 
+^C
+-----------------------------------------
+9.47.66.34:22 <-> 9.47.67.150:36570
+-----------------------------------------
+Socket:
+        Bytes Sent = 208
+        Messages sent = 2
+        Bytes Received = 48
+        Messages Received = 1
+Ip:
+        InReceives = 3
+        OutRequests = 2
+        ReasmTimeout = 0
+        ReasmReqds = 0
+        FragOKs = 0
+        FragFails = 0
+Tcp:
+        ActiveOpens = 0
+        AttemptFails = 0
+        CurrEstab = 0
+        EstabResets = 0
+        InSegs = 3
+        OutRsts = 0
+        OutSegs = 2
+        PassiveOpens = 0
+        RetransSegs = 0
+TcpExt:
+        delayed acks sent = 0
+        times the listen queue of a socket overflowed = 0
+        SYNs to LISTEN sockets ignored = 0
+        tcp memory pressure = 0
+