Using ipio.d

Using `ipio.d`

The following DTrace script traces IP packets and prints various details:

#!/usr/sbin/dtrace -s

#pragma D option quiet
#pragma D option switchrate=10hz

dtrace:::BEGIN
{
        printf(" %3s %10s %15s    %15s %8s %6s\n", "CPU", "DELTA(us)",
            "SOURCE", "DEST", "INT", "BYTES");
        last = timestamp;
}

ip:::send
{
        this->elapsed = (timestamp - last) / 1000;
        printf(" %3d %10d %15s -> %15s %8s %6d\n", cpu, this->elapsed,
            args[2]->ip_saddr, args[2]->ip_daddr, args[3]->if_name,
            args[2]->ip_plength);
        last = timestamp;
}

ip:::receive
{
        this->elapsed = (timestamp - last) / 1000;
        printf(" %3d %10d %15s <- %15s %8s %6d\n", cpu, this->elapsed,
            args[2]->ip_daddr, args[2]->ip_saddr, args[3]->if_name,
            args[2]->ip_plength);
        last = timestamp;
}

This example output shows tracing packets as they pass in and out of tunnels:

# ./ipio.d
 CPU  DELTA(us)          SOURCE               DEST      INT  BYTES
   1     598913    203.0.113.1 ->   192.0.2.55/27  ip.tun0     68
   1         73   192.0.2.3/27 ->     192.0.2.1/27     nge0    140
   1      18325   192.0.2.3/27 <-     192.0.2.1/27     nge0    140
   1         69    203.0.113.1 <-   192.0.2.55/27  ip.tun0     68
   0     102921    203.0.113.1 ->   192.0.2.55/27  ip.tun0     20
   0         79   192.0.2.3/27 ->     192.0.2.1/27     nge0     92

The following fields are printed:

CPU: CPU ID that event occurred on
DELTA (us): Elapsed time since previous event
SOURCE: Source IP address
DEST: Destination IP address
INT: Interface
BYTES: Payload bytes

Tip:

Multi-CPU servers may shuffle the output slightly due to DTrace per-CPU buffering. Monitor changes in the CPU column, or add a timestamp column and post sort.