googerteller/netsendmsg.bt
2022-08-23 12:59:10 +02:00

13 lines
211 B
Plaintext

#!/usr/bin/bpftrace
#include <net/sock.h>
kprobe:udp_sendmsg,
kprobe:tcp_sendmsg
{
$sk = (struct sock *)arg0;
$daddr = ntop($sk->__sk_common.skc_daddr);
printf("%-8d\t%s\t(%s)\n", pid, $daddr, comm);
}