diff options
| author | ddomingo <ddomingo@redhat.com> | 2009-05-07 16:02:51 +1000 |
|---|---|---|
| committer | ddomingo <ddomingo@redhat.com> | 2009-05-07 16:02:51 +1000 |
| commit | b29403a9638895ecd9bc515bb47e3881a53168e8 (patch) | |
| tree | cafded67d9882aec6da7fba3680fcd62e2d59559 /doc/SystemTap_Beginners_Guide/en-US | |
| parent | a6b4f9682a51062a18042f3feb6b80aa40412625 (diff) | |
| download | systemtap-steved-b29403a9638895ecd9bc515bb47e3881a53168e8.tar.gz systemtap-steved-b29403a9638895ecd9bc515bb47e3881a53168e8.tar.xz systemtap-steved-b29403a9638895ecd9bc515bb47e3881a53168e8.zip | |
added tcpdumplike.stp to Network for Fedora build only
Diffstat (limited to 'doc/SystemTap_Beginners_Guide/en-US')
| -rw-r--r-- | doc/SystemTap_Beginners_Guide/en-US/Useful_Scripts-tcpdumplike.xml | 116 | ||||
| -rw-r--r-- | doc/SystemTap_Beginners_Guide/en-US/Useful_SystemTap_Scripts.xml | 2 |
2 files changed, 117 insertions, 1 deletions
diff --git a/doc/SystemTap_Beginners_Guide/en-US/Useful_Scripts-tcpdumplike.xml b/doc/SystemTap_Beginners_Guide/en-US/Useful_Scripts-tcpdumplike.xml new file mode 100644 index 00000000..cd42edc6 --- /dev/null +++ b/doc/SystemTap_Beginners_Guide/en-US/Useful_Scripts-tcpdumplike.xml @@ -0,0 +1,116 @@ +<?xml version='1.0'?> +<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ +]> + + + <section id="tcpdumplikesect"> + <title>Monitoring TCP Packets</title> +<indexterm> +<primary>script examples</primary> +<secondary>monitoring TCP packets</secondary> +</indexterm> + +<indexterm> +<primary>examples of SystemTap scripts</primary> +<secondary>monitoring TCP packets</secondary> +</indexterm> + +<indexterm> +<primary>monitoring TCP packets</primary> +<secondary>examples of SystemTap scripts</secondary> +</indexterm> +<indexterm> + <primary>TCP packets, monitoring</primary> + <secondary>examples of SystemTap scripts</secondary> +</indexterm> +<indexterm> + <primary>TCP packets, monitoring</primary> + <secondary>examples of SystemTap scripts</secondary> +</indexterm> +<!-- +<indexterm> + <primary>script examples</primary> + <secondary>net/socket.c, tracing functions from</secondary> +</indexterm> + +<indexterm> + <primary>examples of SystemTap scripts</primary> + <secondary>net/socket.c, tracing functions from</secondary> +</indexterm> + +<indexterm> + <primary>net/socket.c, tracing functions from</primary> + <secondary>examples of SystemTap scripts</secondary> +</indexterm> +--> + +<para> + This section illustrates how to monitor TCP packets received by the system. This is useful in + analyzing network traffic generated by applications running on the system. +</para> + + +<formalpara id="tcpdumplike"> + <title>tcpdumplike.stp</title> +<para> +<programlisting> + <xi:include parse="text" href="extras/testsuite/systemtap.examples/network/tcpdumplike.stp" xmlns:xi="http://www.w3.org/2001/XInclude" /> +</programlisting> +</para> +</formalpara> + +<para> + While <xref linkend="tcpdumplike"/> is running, it will print out the following information + about any received TCP packets in real time: +</para> + +<itemizedlist> + <listitem><para>Source and destination IP address (<command>saddr</command>, + <command>daddr</command>, respectively)</para></listitem> + <listitem><para>Source and destination ports (<command>sport</command>, <command>dport</command>, + respectively)</para></listitem> + <listitem><para>Packet flags</para></listitem> +</itemizedlist> + +<para> + To determine the flags used by the packet, <xref linkend="tcpdumplike"/> uses the following + functions: +</para> + +<itemizedlist> + <listitem><para><command>urg</command> - urgent</para></listitem> + <listitem><para><command>ack</command> - acknowledgement</para></listitem> + <listitem><para><command>psh</command> - push</para></listitem> + <listitem><para><command>rst</command> - reset</para></listitem> + <listitem><para><command>syn</command> - synchronize</para></listitem> + <listitem><para><command>fin</command> - finished</para></listitem> +</itemizedlist> + +<para> + The aforementioned functions return <command>1</command> or <command>0</command> to + specify whether the packet uses the corresponding flag. +</para> + +<example id="tcpdumplikeoutput"> + <title><xref linkend="tcpdumplike"/> Sample Output</title> +<screen> +-----------------------------------------------------------------
+ Source IP Dest IP SPort DPort U A P R S F
+-----------------------------------------------------------------
+ 209.85.229.147 10.0.2.15 80 20373 0 1 1 0 0 0
+ 92.122.126.240 10.0.2.15 80 53214 0 1 0 0 1 0
+ 92.122.126.240 10.0.2.15 80 53214 0 1 0 0 0 0
+ 209.85.229.118 10.0.2.15 80 63433 0 1 0 0 1 0
+ 209.85.229.118 10.0.2.15 80 63433 0 1 0 0 0 0
+ 209.85.229.147 10.0.2.15 80 21141 0 1 1 0 0 0
+ 209.85.229.147 10.0.2.15 80 21141 0 1 1 0 0 0
+ 209.85.229.147 10.0.2.15 80 21141 0 1 1 0 0 0
+ 209.85.229.147 10.0.2.15 80 21141 0 1 1 0 0 0
+ 209.85.229.147 10.0.2.15 80 21141 0 1 1 0 0 0
+ 209.85.229.118 10.0.2.15 80 63433 0 1 1 0 0 0
+[...] +</screen> +</example> + +</section> + diff --git a/doc/SystemTap_Beginners_Guide/en-US/Useful_SystemTap_Scripts.xml b/doc/SystemTap_Beginners_Guide/en-US/Useful_SystemTap_Scripts.xml index 4d999b53..eeab9b27 100644 --- a/doc/SystemTap_Beginners_Guide/en-US/Useful_SystemTap_Scripts.xml +++ b/doc/SystemTap_Beginners_Guide/en-US/Useful_SystemTap_Scripts.xml @@ -42,7 +42,7 @@ <xi:include href="Useful_Scripts-nettop.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> <xi:include href="Useful_Scripts-sockettrace.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> <xi:include href="Useful_Scripts-tcp_connections.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> - + <xi:include condition="fedora" href="Useful_Scripts-tcpdumplike.xml" xmlns:xi="http://www.w3.org/2001/XInclude" /> </section> <section id="mainsect-disk"> <title>Disk</title> |