BCC源码内容概览（3）

接前一篇文章：BCC源码内容概览（2）

本文参考官网中的Contents部分的介绍。

BCC源码根目录的文件，其中一些是同时包含C和Python的单个文件，另一些是.c和.py的成对文件，还有一些是目录。

跟踪（Tracing）

examples目录下的文件：

• examples/tracing/task_switch.py

从PIDs切换出和切换到的任务切换计数。

• examples/tracing/tcpv4connect.py

跟踪TCP IPv4活动连接。

bcc/examples/tracing/tcpv4connect_example.txt文件内容如下：

Demonstrations of tcpv4connect.py, the Linux eBPF/bcc version.
 
 
This example traces the kernel function performing active TCP IPv4 connections
(eg, via a connect() syscall; accept() are passive connections). Some example
output (IP addresses changed to protect the innocent):
 
# ./tcpv4connect.py
PID    COMM         SADDR            DADDR            DPORT
1479   telnet       127.0.0.1        127.0.0.1        23  
1469   curl         10.201.219.236   54.245.105.25    80  
1469   curl         10.201.219.236   54.67.101.145    80  
 
This output shows three connections, one from a "telnet" process and two from
"curl". The output details shows the source address, destination address,
and destination port. This traces attempted connections: these may have failed.
 
The overhead of this tool should be negligible, since it is only tracing the
kernel function performing a connect. It is not tracing every packet and then
filtering.
 
This is provided as a basic example of TCP tracing. See tools/tcpconnect for a
more featured version of this example (a tool).

• examples/tracing/trace_fields.py

打印跟踪事件中的字段的简单示例。

• examples/tracing/undump.py

转储UNIX套接字包。

bcc/examples/tracing/tundump_example.txt文件内容如下：

Demonstrations of undump.py, the Linux eBPF/bcc version.
 
This example trace the kernel function performing receive AP_UNIX socket
packet. Some example output:
 
Terminal 1, UNIX Socket Server:
 
```
$ nc -lU /var/tmp/dsocket
# receive from Client
Hello, World
abcdefg
```
 
Terminal 2, UNIX socket Client:
 
```
$ nc -U /var/tmp/dsocket
# Input some lines
Hello, World
abcdefg
```
 
Terminal 3, receive tracing:
 
```
$ sudo python undump.py -p 49264
Tracing PID=49264 UNIX socket packets ... Hit Ctrl-C to end
 
# Here print bytes of receive
PID 49264 Recv 13 bytes
   48 65 6c 6c 6f 2c 20 57 6f 72 6c 64 0a
PID 49264 Recv 8 bytes
   61 62 63 64 65 66 67 0a
```
 
This output shows two packet received by PID 49264(nc -lU /var/tmp/dsocket),
`Hello, World` will be parsed as `48 65 6c 6c 6f 2c 20 57 6f 72 6c 64 0a`, the
`0a` is `Enter`. `abcdefg` will be parsed as `61 62 63 64 65 66 67 0a`.