nettrace

nettrace is is a powerful tool to trace network packet and diagnose network problem inside kernel on TencentOS. It make use of eBPF and BCC.

BCC (BPF Compiler Collection) is a toolkit to make eBPF programs easier to write, with kernel instrumentation in C (and includes a C wrapper around LLVM), and front-ends in Python and lua.

'skb' is the struct that used in kernel to store network package. By tracing kernel function and tracepoint (with the help of kprobe based on eBPF) that handle skb, nettrace is able to show the path of skb bypass inside kernel network stack. Therefor, some network issue (such as package drop) can be solved simply.

1. install

1.1 source code

For centos, the package 'bcc' should be installed; For ubuntu, the package 'bpfcc-tools' shoudl be installed.

Then, simply download the source code and run 'nettrace.py' in it.

1.2 rpm

Download the rpm package from the release and install it. Then you can run 'nettrace' command.

1.3 docker

Download the docker image in the release. You can use it in two ways:

Way 1:

import the image to docker with the command:

docker import ./docker-nettrace.tar.bz2 nettrace

and create the container with command:

docker run -itd -v /usr/src/:/usr/src/ -v /lib/modules/:/lib/modules/ --name nettrace --privileged nettrace bash

Then, you can enter the container with command:

docker exec -it nettrace bash

and use the command 'nettrace' in it.

Way 2:

directly unzip the tar file with the command mkdir nettrace && tar -xf ./docker-nettrace.tar.bz2 -C nettrace and run the command cd nettrace && ./ntenter.sh, then you can use the command 'nettrace'.

the command ./ntenter.sh clean is able to umount the mountpoint and header files that it created, so run this command to do the clean job if you don't need nettrace anymore.

2. usage

2.1 Base usage

Below is the basic usage of nettrace to trace icmp package with ip address 10.35.13.63. The kernel function that skb bypass, timestamp and basic icmp information are printed.

$ nettrace -p icmp --addr 10.35.13.63                                                
begin tracing......
453516.922978: [napi_gro_receive        ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.922998: [enqueue_to_backlog      ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.923012: [__netif_receive_skb_core]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.923019: [tpacket_rcv             ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.923025: [ip_rcv                  ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.923028: [ip_rcv_core             ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.923032: [skb_clone               ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.923036: [nf_hook_slow            ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.923055: [ip_rcv_finish           ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.923061: [ip_local_deliver        ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.923063: [nf_hook_slow            ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
453516.923070: [ip_local_deliver_finish ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1

With --detail specified, more information can be see:

$ nettrace -p icmp --addr 10.35.13.63 --detail
begin tracing......
454861.534996: [ffff8887b6260800][2:eth1][pid:0,swapper/3][link-in     ][napi_gro_receive        ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
454861.535022: [ffff8887b6260800][2:eth1][pid:0,swapper/3][link-in     ][enqueue_to_backlog      ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
454861.535048: [ffff8887b6260800][2:eth1][pid:0,swapper/2][link-in     ][__netif_receive_skb_core]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
454861.535060: [ffff8887b6260800][2:eth1][pid:0,swapper/2][pkt-in      ][tpacket_rcv             ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
454861.535070: [ffff8887b6260800][2:eth1][pid:0,swapper/2][ip-in       ][ip_rcv                  ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
454861.535078: [ffff8887b6260800][2:eth1][pid:0,swapper/2][ip-in       ][ip_rcv_core             ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
454861.535086: [ffff8887b6260800][2:eth1][pid:0,swapper/2][life        ][skb_clone               ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
454861.535094: [ffff88858f242100][2:eth1][pid:0,swapper/2][netfilter   ][nf_hook_slow            ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
454861.535119: [ffff88858f242100][2:eth1][pid:0,swapper/2][ip-in       ][ip_rcv_finish           ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
454861.535129: [ffff88858f242100][2:eth1][pid:0,swapper/2][ip-in       ][ip_local_deliver        ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1

As we can see, the address of skb, network interface, current process and the tracer that the function belongs to are displayed.

2.2 optional

$ nettrace -h
usage: nettrace.py [-h] [-s SADDR] [-d DADDR] [--addr ADDR] [-p PROTO] [--dport DPORT] [--sport SPORT] [--port PORT] [--tcp-flags TCP_FLAGS] [-t TRACER] [-o OUTPUT] [--detail] [--stack] [--stack-tracer STACK_TRACER] [--force-stack] [--ret] [--timeline] [-c COUNT] [--skb-mode] [-v]

optional arguments:
  -h, --help            show this help message and exit
  -s SADDR, --saddr SADDR
                        ip source address
  -d DADDR, --daddr DADDR
                        ip dest address
  --addr ADDR           ip source or dest address
  -p PROTO, --proto PROTO
                        network protocol (L3 or L4) in lower case, such ip, tcp, udp, etc.
  --dport DPORT         TCP/UDP dest port
  --sport SPORT         TCP/UDP source port
  --port PORT           TCP/UDP source or dest port
  --tcp-flags TCP_FLAGS
                        TCP flags to filter, such as S(syn), A(ack), R(rst), etc
  -t TRACER, --tracer TRACER
                        The network module or kernel function to trace. Use "-t ?" to see available tracer
  -o OUTPUT, --output OUTPUT
                        print extern info. options include: pid, if, id, cpu and module. pid: process info; if: ifindex and ifname; id: memory address of skb; cpu: the cpu id that run on; module: the network module of the tracer belong to. multiple options should be splited by ","
  --detail              show all info for trace output, which means enable all options in "--output"
  --stack               print kernel function call stack
  --stack-tracer STACK_TRACER
                        print kernel call stack for special tracer.
  --force-stack         force print stack for "all" tracer
  --ret                 trace the return value
  --timeline            print skb on timeline
  -c COUNT, --count COUNT
                        skb count to trace (timeline should be enabled)
  --skb-mode            keep tracing skb once it is matched
  -v, --verbose         show more verbose info

--stack: print the function call stack for the kernel function or tracepoint that enabled.
--stack-tracer: maybe you don't want to print stack for all kernel function that enable, you can specify the tracer (or kernel function) that you want to print stack.
--force_stack: by default, you can't set -t all and --stack together for performance problem. With this option, you can do it.
--tcp-flags: use tcp flags to filter tcp skb. S(syn), A(ack), R(rst) and P(push) are supported.
--ret: once this enabled, both kprobe and kretprobe will be create for kernel function in the tracer that enabled, and the return value will be printed.

2.3 example

trace icmp package with source ip '192.168.1.8':

# nettrace -p icmp -s 192.168.1.8

trace tcp package with source ip '192.168.1.8' and syn+ack flags:

# nettrace -p tcp -s 192.168.1.8 --tcp-flags SA

trace icmp package with source ip '192.168.1.8' in ip and icmp layer:

# nettrace -p icmp -s 192.168.1.8 -t ip,icmp

trace icmp package with source ip '192.168.1.8' in timeline mode:

# nettrace -p icmp -s 192.168.1.8 --timeline

trace icmp package with source ip '192.168.1.8' in skb mode:

# nettrace -p icmp -s 192.168.1.8 --skb-mode

trace icmp package with source ip '192.168.1.8' and print detail information

# nettrace -p icmp -s 192.168.1.8 --detail

3. tracer

3.1 trace tree

kernel function and tracepoint are organized in a 'tracer' tree, and every node of the tree is a tracer. 'all' is the root of the 'tracer' tree. The tree can be displayed with the command: nettrace -t ?

$ nettrace -t ?
available tracer:
---------------------------------------------------

all: trace the whole kernel network stack
    link: link layer (L2) of the network stack
        link-in: link layer (L2) of packet in
            napi_gro_receive
            enqueue_to_backlog
            __netif_receive_skb_core
            do_xdp_generic
            xdp_do_generic_redirect
            generic_xdp_tx
            sch_handle_ingress
        link-out: link layer (L2) of packet out
            dev_queue_xmit
            dev_hard_start_xmit
        sched: TC(traffic control) module
            tcf_classify
            sch_handle_egress
            cls_bpf_classify
            tcf_bpf_act
......

This is the part of the tracer tree. 'link' just represent the link layer (L2) of the network stack, and 'link-in' represent receive package, 'link-out' represent send package. 'ip' represent ip layer, 'tcp' represent tcp layer, etc.

When trace skb, tracer can be specified by -t (or --tracer), and multiple are supported. By default, 'all' tracer is used. For example, nettrace -t napi_gro_receive,ip to trace the function napi_gro_receive (function is tracer too) and ip layer.

3.2. custom

Tracer tree is keep in tracer.json, so it is simple to extend your own tracer. Leaf node of the tree can be the kernel function or tracepoint that we want to trace, and they have the following fields:

name: The name of kernel function or tracepoint.
skb: For kprobe, this is the index of 'struct sk_buff' in the function params which begin from 0; For tracepoint, this is the name of 'struct sk_buff', which may be 'skbaddr'.
type: the type of this item, which can be 'kprobe' by default, 'kretprobe' and 'tracepoint'.
tp: this is for tracpoint, which shoud be the path of tracepint in format of 'skb:kfree_skb'.
is_end: if this function/tracepoint is the end of the life of the skb. This is used to trace the life of skb.
regex: the regex for kernel function name. Sometimes, the function name compiled can be different, such as 'do_xdp_generic' is compiled to 'do_xdp_generic.cold'. So we can use regex to match the compiled name with 'do_xdp_generic.*'.

If nettrace is used by rpm package or docker image, the 'tracer.json' is located in '/opt/nettrace/tracer.json'.

4. timeline mode

By default, kernel function are printed directly. It's not easy to distinguish single skb, especially multi skb are printed at the same time. To solve this problem, timeline mode is introduced. In this mode, every skb has a 'context', which is used to mange the life of the skb. The skb won't be printed until it 'dies', and it will be print singly:

$ nettrace -p icmp --addr 10.35.13.63 --detail --timeline
begin tracing......
<------------------- skb: ffff88858f243100 ---------------------->
456901.372837: [ffff8887b6260200][2:eth1][pid:0,swapper/3       ][link-in     ][napi_gro_receive        ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.372863: [ffff8887b6260200][2:eth1][pid:0,swapper/3       ][link-in     ][enqueue_to_backlog      ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.372883: [ffff8887b6260200][2:eth1][pid:897081,nettrace   ][link-in     ][__netif_receive_skb_core]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.372893: [ffff8887b6260200][2:eth1][pid:897081,nettrace   ][pkt-in      ][tpacket_rcv             ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.372902: [ffff8887b6260200][2:eth1][pid:897081,nettrace   ][ip-in       ][ip_rcv                  ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.372909: [ffff8887b6260200][2:eth1][pid:897081,nettrace   ][ip-in       ][ip_rcv_core             ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.372921: [ffff8887b6260200][2:eth1][pid:897081,nettrace   ][life        ][skb_clone               ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
                return value:ffff88858f242900
456901.372930: [ffff88858f242900][2:eth1][pid:897081,nettrace   ][netfilter   ][nf_hook_slow            ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.372952: [ffff88858f242900][2:eth1][pid:897081,nettrace   ][ip-in       ][ip_rcv_finish           ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.372961: [ffff88858f242900][2:eth1][pid:897081,nettrace   ][ip-in       ][ip_local_deliver        ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.372967: [ffff88858f242900][2:eth1][pid:897081,nettrace   ][netfilter   ][nf_hook_slow            ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.372977: [ffff88858f242900][2:eth1][pid:897081,nettrace   ][ip-in       ][ip_local_deliver_finish ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.373002: [ffff88858f242900][2:eth1][pid:897081,nettrace   ][icmp-in     ][icmp_rcv                ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.373006: [ffff88858f242900][2:eth1][pid:897081,nettrace   ][icmp-in     ][icmp_echo               ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.373064: [ffff88858f242900][2:eth1][pid:897081,nettrace   ][life        ][consume_skb             ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.373068: [ffff8887b6260200][2:eth1][pid:897081,nettrace   ][pkt-in      ][packet_rcv              ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1
456901.373072: [ffff8887b6260200][2:eth1][pid:897081,nettrace   ][life        ][consume_skb             ]: ICMP: 10.35.13.63 -> 9.135.224.89, ping request   , seq: 1

<------------------- skb: ffff88858f243a00 ---------------------->
461052.796174: [ffff88858f243a00][    ][pid:0,swapper/2         ][ip-out      ][ip_send_skb             ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796179: [ffff88858f243a00][    ][pid:0,swapper/2         ][ip-out      ][__ip_local_out          ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796182: [ffff88858f243a00][    ][pid:0,swapper/2         ][netfilter   ][nf_hook_slow            ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796186: [ffff88858f243a00][    ][pid:0,swapper/2         ][ip-out      ][ip_output               ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796189: [ffff88858f243a00][2:eth1][pid:0,swapper/2       ][netfilter   ][nf_hook_slow            ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796194: [ffff88858f243a00][2:eth1][pid:0,swapper/2       ][ip-out      ][ip_finish_output        ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796197: [ffff88858f243a00][2:eth1][pid:0,swapper/2       ][ip-out      ][ip_finish_output2       ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796203: [ffff88858f243a00][2:eth1][pid:0,swapper/2       ][link-out    ][dev_queue_xmit          ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796210: [ffff88858f243a00][2:eth1][pid:0,swapper/2       ][link-out    ][dev_hard_start_xmit     ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796214: [ffff88858f243a00][2:eth1][pid:0,swapper/2       ][life        ][skb_clone               ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
                return value:ffff88858f242900
461052.796219: [ffff88858f242900][2:eth1][pid:0,swapper/2       ][pkt-in      ][tpacket_rcv             ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796224: [ffff88858f242900][2:eth1][pid:0,swapper/2       ][life        ][consume_skb             ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1
461052.796264: [ffff88858f243a00][2:eth1][pid:0,swapper/0       ][life        ][consume_skb             ]: ICMP: 9.135.224.89 -> 10.35.13.63, ping reply     , seq: 1

As we can see, printing for every skb are split clearly. What's more, the skb cloned from one skb is thought to be in the same context. Therefor, the skb with address ffff8887b6260200 is printed with ffff88858f242900 together.

5. skb mode

Traditional packet filter is supported, such protocol, ip source address, ip destination address, source port, destination port, etc. However, while the data of skb changing (for example, NAT), it can't work probably.

skb mode is used to solve this problem. While it is enabled with --skb-mode, nettrace will keep tracing the skb once it is matched, even if ip address or port changed. This mode is helpful when you want to trace the skb whose data will be change by iptables.

As we can see below, we want to trace icmp package with ip address 192.168.122.8. However, DNAT is done by iptables, and the ip source address of this skb changed to 9.135.224.89. With this mode enabled, we still can keep tracing it.

$ nettrace -p icmp --addr 192.168.122.8 --timeline --skb-mode
begin tracing......
<------------------- skb: ffff88818f02f900 ---------------------->
463697.331957: [__netif_receive_skb_core]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.331972: [nf_hook_slow            ]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.331985: [nf_hook_slow            ]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.331990: [__netif_receive_skb_core]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.331994: [ip_rcv                  ]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.331998: [ip_rcv_core             ]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.332001: [nf_hook_slow            ]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.332004: [ip_rcv_finish           ]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.332010: [ip_forward              ]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.332014: [nf_hook_slow            ]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.332024: [ip_output               ]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.332027: [nf_hook_slow            ]: ICMP: 192.168.122.8 -> 10.123.119.98, ping request   , seq: 0
463697.332037: [ip_finish_output        ]: ICMP: 9.135.224.89  -> 10.123.119.98, ping request   , seq: 0
463697.332039: [ip_finish_output2       ]: ICMP: 9.135.224.89  -> 10.123.119.98, ping request   , seq: 0
463697.332042: [dev_queue_xmit          ]: ICMP: 9.135.224.89  -> 10.123.119.98, ping request   , seq: 0
463697.332046: [dev_hard_start_xmit     ]: ICMP: 9.135.224.89  -> 10.123.119.98, ping request   , seq: 0
463697.332060: [consume_skb             ]: ICMP: 9.135.224.89  -> 10.123.119.98, ping request   , seq: 0

For kernel versions that do not support drop reason, or drop point that has not yet been traced, it may be helpful to show the call stack of kfree_skb, so that we can infer the drop reason.

eg:

nettrace -p udp --diag  --diag-quiet --diag-stack
...
[1] ERROR happens in kfree_skb(life):
	packet is dropped by kernel
    location:
	__udp4_lib_rcv+0x8fe
    stack:
       __udp4_lib_rcv ([kernel.kallsyms])
       ip_protocol_deliver_rcu ([kernel.kallsyms])
       ip_local_deliver_finish ([kernel.kallsyms])
       ip_local_deliver ([kernel.kallsyms])
       ip_rcv_finish ([kernel.kallsyms])
       ip_rcv ([kernel.kallsyms])
       __netif_receive_skb_core ([kernel.kallsyms])
       __netif_receive_skb_list_core ([kernel.kallsyms])
       netif_receive_skb_list_internal ([kernel.kallsyms])
       gro_normal_list.part.143 ([kernel.kallsyms])
       napi_complete_done ([kernel.kallsyms])
       virtnet_poll ([kernel.kallsyms])
       net_rx_action ([kernel.kallsyms])

enhancement

A powerful framework for decentralized federated learning with user-defined communication topology

Scatterbrained Decentralized Federated Learning Scatterbrained makes it easy to build federated learning systems. In addition to traditional federated

Johns Hopkins Applied Physics Laboratory

7 Sep 26, 2022

Tool to get the top 100 of the fastest nodes in the Tor network. Based on Kirzahk tool.

Tor Network Top 100 IPs Tool to get the top 100 of the fastest nodes in the Tor network. Based on Kirzahk tool. Just execute top100ipstor.py to get th

0 Jan 23, 2022

This is a python based command line Network Scanner utility, which input as an argument for the exact IP address or the relative IP Address range you wish to do the Network Scan for and returns all the available IP addresses with their MAC addresses on your current Network.

1 Feb 9, 2022

ANalyse is a vehicle network analysis and attack tool.

ubuntu installation failed

The installation of multiple packages under ubuntu16.04 20.04 fails, and the droptrace compilation prompts that the current kernel is not supported, but the 5.4 and 5.18 kernels have been tried
bug

opened by chiao666 4

add option to show kfree_skb call stack

opened by curu 1

clean up code by remove 'bss' map

It is not necessary to maintain the 'bss' map, which is used to store the config data. The map m_config is enough.

Signed-off-by: Menglong Dong [email protected]

opened by xmmgithub 0

v1.2.3(Dec 9, 2022)
新增了一些特性，包括：

完善了对于IPv6的支持

提供了使用docker进行编译的方式

对arm64架构提供了支持

新增kfree_skb打印内核堆栈功能

后续将只提供支持BTF内核的版本，对于低版本内核，请自行基于docker进行编译
Source code(tar.gz)
Source code(zip)
nettrace-1.2.3-1.tl3.aarch64.rpm(2.16 MB)
nettrace-1.2.3-1.tl3.aarch64.tar.bz2(2.37 MB)
nettrace-1.2.3-1.tl3.x86_64.rpm(2.46 MB)
nettrace-1.2.3-1.tl3.x86_64.tar.bz2(2.64 MB)
nettrace-1.2.3-2.amd64.deb(885.82 KB)
nettrace-1.2.3-2.arm64.deb(897.48 KB)
v1.2.2(Oct 22, 2022)

增加了一些新特性，包括：

1、支持以CORE的方式读取数据，可以做到兼容所有高版本内核（>=5.3），无需重新编译； 2、将intel改名为diag 3、删除droptrace，将其合并到nettrace 4、增加IPv6支持 5、支持显示日期格式的时间

版本>=5.3且开启了BTF支持的内核，可以直接下载nettrace-1.2.2-1.btf对应的rpm/deb安装，nettrace-1.2.2-1.btf.tar.bz2里面放的是编译好的二进制程序；低版本内核，需要手动编译后才能使用哦~
Source code(tar.gz)
Source code(zip)
nettrace-1.2.2-1.btf.tar.bz2(2.21 MB)
nettrace-1.2.2-1.btf.x86_64.deb(790.79 KB)
nettrace-1.2.2-1.btf.x86_64.rpm(2.18 MB)
nettrace-1.2.2-1.ubuntu18.04.tar.bz2(2.66 MB)
nettrace-1.2.2-1.ubuntu18.04.x86_64.deb(1012.33 KB)
v1.2.1(Aug 4, 2022)
改了很多东西，不知从何说起，主要还是兼容性和问题修复吧：

做了各个内核版本的兼容性适配，包括4.14/4.15/5.4/5.18等内核版本（太难了，ubuntu16/18的内核是个坑）

修复了报文过滤不准确的问题（出现了不该出现的报文）

Source code(tar.gz)
Source code(zip)
nettrace-1.2.1-1.tl2.src.rpm(3.45 MB)
nettrace-1.2.1-1.tl2.tar.bz2(2.52 MB)
nettrace-1.2.1-1.tl2.x86_64.rpm(2.49 MB)
nettrace-1.2.1-1.tl3.src.rpm(3.45 MB)
nettrace-1.2.1-1.tl3.tar.bz2(2.85 MB)
nettrace-1.2.1-1.tl3.x86_64.rpm(1.97 MB)
nettrace-1.2.1-1.ubuntu-5.18.x86_64.deb(759.99 KB)
nettrace-1.2.1-1.ubuntu18.04.tar.bz2(2.53 MB)
nettrace-1.2.1-1.ubuntu18.04.x86_64.deb(969.71 KB)
nettrace-1.2.1-1.ubuntu22.04.tar.bz2(2.09 MB)
nettrace-1.2.1-1.ubuntu22.04.x86_64.deb(773.21 KB)
nettrace-1.2.1-1.ubuntu_5.18.tar.bz2(2.88 MB)
v1.2.0(Jul 20, 2022)

网络诊断功能基本完成。这个release里同时完成了文档和man手册的编写。网络诊断功能目前在5.4-5.10版本的内核进行了验证和适配，能满足这些版本的要求。对于更高或者更低的内核版本，暂未进行适配，可能会出现一些问题。
Source code(tar.gz)
Source code(zip)
nettrace-1.2.0-1.tl3.x86_64.rpm(2.54 MB)
nettrace-1.2.0.tar.bz2(3.77 MB)
v1.0.0(Jun 2, 2022)
引入了droptrace、nodetrace等工具

新增“打包模式”，将nettrace打包成单个可执行python文件

附件中的压缩包为编译好的可直接使用的工具
Source code(tar.gz)
Source code(zip)
nettrace-1.0.0-1.tl3.x86_64.rpm(1.95 MB)
nettrace-1.0.0.tar.bz2(2.00 MB)
v0.1.3(Dec 21, 2021)

Source code(tar.gz)
Source code(zip)
docker-nettrace.tar.bz2(117.61 MB)
nettrace-0.1.3-1.tl3.x86_64.rpm(23.03 KB)

nettrace is a powerful tool to trace network packet and diagnose network problem inside kernel.

Related tags

Overview

nettrace

1. install

1.1 source code

1.2 rpm

1.3 docker

2. usage

2.1 Base usage

2.2 optional

2.3 example

3. tracer

3.1 trace tree

3.2. custom

4. timeline mode

5. skb mode

You might also like...

A powerful framework for decentralized federated learning with user-defined communication topology

Tool to get the top 100 of the fastest nodes in the Tor network. Based on Kirzahk tool.

This is a python based command line Network Scanner utility, which input as an argument for the exact IP address or the relative IP Address range you wish to do the Network Scan for and returns all the available IP addresses with their MAC addresses on your current Network.

ANalyse is a vehicle network analysis and attack tool.

A Network tool kit for scanning active IP addresses and open ports

this is demo of tool dosploit for test and dos in network with python

Tool for pretty printing and optimizing Lightning Network channels.

Network monitoring tool

Nautobot is a Network Source of Truth and Network Automation Platform.

Comments

ubuntu installation failed

add option to show kfree_skb call stack

clean up code by remove 'bss' map

Releases(v1.2.3)

v1.2.3(Dec 9, 2022)

v1.2.2(Oct 22, 2022)

v1.2.1(Aug 4, 2022)

v1.2.0(Jul 20, 2022)

v1.0.0(Jun 2, 2022)

v0.1.3(Dec 21, 2021)

Owner

Official ProtonVPN Linux app

Simplest dashboard for WireGuard VPN written in Python w/ Flask

Vent domain information retrieval tool, which is capable of retrieving customer information

Python 3 tool for finding unclaimed groups on Roblox. Supports multi-threading, multi-processing and HTTP proxies.

Rufus is a Dos tool written in Python3.

Proxlist - Retrieve proxy servers.

Socialhome is best described as a federated personal profile with social networking functionality

Repo for investigation of timeouts that happens with prolonged training on clients

MS Iot Device Can Platform

An HTML interface for finetuning the sync map output from aeneas

D-dos attack GUI tool written in python using tkinter module

Repo used to maintain all notes and scripts developed during my DevNet Expert studies

Pesquise, filtre e obtenha informações sobre animes. ( Módulo PIP )

DNSStager is an open-source project based on Python used to hide and transfer your payload using DNS.

This is a small python code that I use with my NAS server connected to Plex

This tool is for finding more detailed information of an IP Address.

libsigrok stacked Protocol Decoder for TPM 2.0 transactions from an SPI bus. BitLocker Volume Master Key (VMK) are automatically extracted.

A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228

ProtOSINT is a Python script that helps you investigate Protonmail accounts and ProtonVPN IP addresses

ARTEMIS: Real-Time Detection and Automatic Mitigation for BGP Prefix Hijacking.