Re: More detailed networking info needed

[Alex Iribarren <alex dot iribarren dot lists at gmail dot com>]

Hi,

I've had similar requirements for some of the stuff I've done. I had to
write a script to log all network connections and produce output like this:

Aug 20 14:21:19 host03 netlog: sshd[3199]: TCP connect start
29.38.40.128:22 <- 11.127.2.21:30471 (uid=0)
Aug 20 14:23:19 host03 netlog: sshd[8150]: TCP connect stop
29.38.40.128:22 <-> 11.127.2.21:30471 (uid=0)
Aug 20 14:25:03 host03 netlog: wget[2749]: TCP connect start
29.38.40.128:3023 -> 209.85.129.104:80 (uid=123)
Aug 20 14:25:03 host03 netlog: wget[2749]: TCP connect stop
29.38.40.128:3023 <-> 209.85.129.104:80 (uid=123)

I did it by probing several low-level kernel functions and I had to use
lots of C code to extract the information. I'd be very interested in
seeing if you come up with a better way of doing it.

Cheers,
Alex

patrick mccormick wrote:
> Hello list,
>
> We have been working on some systemtap scripts that collect networking
> information such as: packets/bytes sent and received on what interface,
> by which pid, successes and failures, tcp or udp...which is about
> everything we could find using the Systemtap wiki and the tapset
> documentation.
>
> But we would like to find out more information, specifically: source and
> destination IPs of incoming and outgoing packets (w/ associated pids),
> and possibly open ports and their associated pids + any traffic over
> them.
>
> So our questions are really: Are there functions/probes in the tapset
> that can grab this information that we have been missing? and can anyone
> point us in the right direction to write our own probes or functions to
> pull this stuff out?
>
> Thanks for any help,
>
> Patrick McCormick
> Rachel Rodgers
>
> IBM LTC Interns
>
>
>

Attachment: signature.asc
Description: OpenPGP digital signature