OwlCyberSecurity - MANAGER

Edit File: tcpsynbl.bt

#!/usr/bin/env bpftrace /* * tcpsynbl - Show TCP SYN backlog as a histogram. * * See BPF Performance Tools, Chapter 10, for an explanation of this tool. * * Copyright (c) 2019 Brendan Gregg. * Licensed under the Apache License, Version 2.0 (the "License"). * This was originally created for the BPF Performance Tools book * published by Addison Wesley. ISBN-13: 9780136554820 * When copying or porting, include this comment. * * 19-Apr-2019 Brendan Gregg Created this. */ #ifndef BPFTRACE_HAVE_BTF #include <net/sock.h> #endif BEGIN { printf("Tracing SYN backlog size. Ctrl-C to end.\n"); } kprobe:tcp_v4_syn_recv_sock, kprobe:tcp_v6_syn_recv_sock { $sock = (struct sock *)arg0; @backlog[$sock->sk_max_ack_backlog & 0xffffffff] = hist($sock->sk_ack_backlog); if ($sock->sk_ack_backlog > $sock->sk_max_ack_backlog) { time("%H:%M:%S dropping a SYN.\n"); } } END { printf("\n@backlog[backlog limit]: histogram of backlog size\n"); }