@@ -39,15 +39,17 @@ well-known `AF_PACKET` existing utilities) can be as simple as:
3939
4040```
4141$ retis collect
42- Collector(s) started: nft, skb, ct , skb-tracking , skb-drop
42+ Collector(s) started: ct, nft, dev, skb , skb-drop , skb-tracking, ns
4343No probe(s) given: using tp:net:netif_receive_skb, tp:net:net_dev_start_xmit
44447 probe(s) loaded
4545
46- 6034438235097 (9) [ping] 22026 [tp] net:net_dev_start_xmit #57d008c23d9ffff93bc8e6a6580 (skb ffff93bc8fe2f700)
47- if 4 (wlp82s0) [redacted] > 2606:4700:4700::1111 ttl 64 label 0x87f1c len 64 proto ICMPv6 (58) type 128 code 0
46+ 10041392747167 (9) [ping] 23932 [tp] net:net_dev_start_xmit #921f1a5d29fffff8ca2dd79f440 (skb ffff8ca30bbc3100)
47+ [redacted] > 2606:4700:4700::1111 ttl 64 label 0x18000 len 64 proto ICMPv6 (58) type 128 code 0
48+ ns 0x1/4026531840 if 4 (wlp82s0)
4849
49- 6034449727598 (5) [irq/185-iwlwifi] 1359 [tp] net:netif_receive_skb #57d013b806effff93bc8b645180 (skb ffff93bc81f0d300)
50- if 4 (wlp82s0) 2606:4700:4700::1111 > [redacted] ttl 54 label 0x9f52e len 64 proto ICMPv6 (58) type 129 code 0
50+ 10041404857427 (0) [irq/177-iwlwifi] 1907 [tp] net:netif_receive_skb #921f25e9c53ffff8ca1c2e62100 (skb ffff8ca00f09f500)
51+ 2606:4700:4700::1111 > [redacted] ttl 54 label 0xb57aa len 64 proto ICMPv6 (58) type 129 code 0
52+ ns 0x1/4026531840 if 4 (wlp82s0)
5153```
5254
5355The output is described in the [ official
@@ -60,31 +62,43 @@ profile](retis/profiles/generic.yaml) which defines a bigger set of probes.
6062```
6163$ retis -p generic collect -f 'udp port 53 and host 2606:4700:4700::1111'
6264L2+L3 packet filter(s) loaded
63- 29 probe(s) loaded
64-
65- 6464781565852 (10) [isc-net-0000] 22818/22819 [k] ip6_output #5e133023f9cffff93bc85f28a00 (skb ffff93bc8148b000)
66- [redacted].60578 > 2606:4700:4700::1111.53 ttl 64 label 0x116de len 59 proto UDP (17) len 51
67-
68- 6464781577262 (10) [isc-net-0000] 22818/22819 [tp] net:net_dev_queue #5e133023f9cffff93bc85f28a00 (skb ffff93bc8148b000)
69- if 4 (wlp82s0) [redacted].60578 > 2606:4700:4700::1111.53 ttl 64 label 0x116de len 59 proto UDP (17) len 51
70-
71- 6464781579859 (10) [isc-net-0000] 22818/22819 [tp] net:net_dev_start_xmit #5e133023f9cffff93bc85f28a00 (skb ffff93bc8148b000)
72- if 4 (wlp82s0) [redacted].60578 > 2606:4700:4700::1111.53 ttl 64 label 0x116de len 59 proto UDP (17) len 51
73-
74- 6464794631087 (11) [irq/191-iwlwifi] 1365 [tp] net:napi_gro_receive_entry #5e133c99bafffff93bc89dd4000 (skb ffff93bfd77f9f00)
75- if 4 (wlp82s0) 2606:4700:4700::1111.53 > [redacted].60578 ttl 54 label 0xfacb2 len 79 proto UDP (17) len 71
76-
77- 6464794636532 (11) [irq/191-iwlwifi] 1365 [k] udp6_gro_receive #5e133c99bafffff93bc89dd4000 (skb ffff93bfd77f9f00)
78- if 4 (wlp82s0) 2606:4700:4700::1111.53 > [redacted].60578 ttl 54 label 0xfacb2 len 79 proto UDP (17) len 71
79-
80- 6464794638402 (11) [irq/191-iwlwifi] 1365 [k] udp_gro_receive #5e133c99bafffff93bc89dd4000 (skb ffff93bfd77f9f00)
81- if 4 (wlp82s0) 2606:4700:4700::1111.53 > [redacted].60578 ttl 54 label 0xfacb2 len 79 proto UDP (17) len 71
82-
83- 6464794640624 (11) [irq/191-iwlwifi] 1365 [tp] net:netif_receive_skb #5e133c99bafffff93bc89dd4000 (skb ffff93bfd77f9f00)
84- if 4 (wlp82s0) 2606:4700:4700::1111.53 > [redacted].60578 ttl 54 label 0xfacb2 len 79 proto UDP (17) len 71
85-
86- 6464794657429 (11) [irq/191-iwlwifi] 1365 [k] udpv6_rcv #5e133c99bafffff93bc89dd4000 (skb ffff93bfd77f9f00)
87- if 4 (wlp82s0) rxif 4 2606:4700:4700::1111.53 > [redacted].60578 ttl 54 label 0xfacb2 len 79 proto UDP (17) len 71
65+ 30 probe(s) loaded
66+
67+ 12313349514683 (1) [isc-net-0000] 26822/26823 [k] ip6_output #b32ecd2e5bbffff8ca00f0c6100 (skb ffff8ca396cf4600)
68+ [redacted].43366 > 2606:4700:4700::1111.53 ttl 64 label 0x10c7e len 59 proto UDP (17) len 51
69+ ns 0x1/4026531840
70+ ct_state NEW status 0x100 udp orig [[redacted].43366 > 2606:4700:4700::1111.53] reply [2606:4700:4700::1111.53 > [redacted].43366] zone 0 mark 0
71+
72+ 12313349527752 (1) [isc-net-0000] 26822/26823 [tp] net:net_dev_queue #b32ecd2e5bbffff8ca00f0c6100 (skb ffff8ca396cf4600)
73+ [redacted].43366 > 2606:4700:4700::1111.53 ttl 64 label 0x10c7e len 59 proto UDP (17) len 51
74+ ns 0x1/4026531840 if 4 (wlp82s0)
75+ ct_state NEW status 0x188 udp orig [[redacted].43366 > 2606:4700:4700::1111.53] reply [2606:4700:4700::1111.53 > [redacted].43366] zone 0 mark 0
76+
77+ 12313349531477 (1) [isc-net-0000] 26822/26823 [tp] net:net_dev_start_xmit #b32ecd2e5bbffff8ca00f0c6100 (skb ffff8ca396cf4600)
78+ [redacted].43366 > 2606:4700:4700::1111.53 ttl 64 label 0x10c7e len 59 proto UDP (17) len 51
79+ ns 0x1/4026531840 if 4 (wlp82s0)
80+ ct_state NEW status 0x188 udp orig [[redacted].43366 > 2606:4700:4700::1111.53] reply [2606:4700:4700::1111.53 > [redacted].43366] zone 0 mark 0
81+
82+ 12313364132752 (4) [irq/181-iwlwifi] 1911 [tp] net:napi_gro_receive_entry #b32edb1f390ffff8ca3036e3c80 (skb ffff8ca325f87900)
83+ 2606:4700:4700::1111.53 > [redacted].43366 ttl 54 label 0xfe6f0 len 79 proto UDP (17) len 71
84+ ns 0x1/4026531840 if 4 (wlp82s0)
85+
86+ 12313364139400 (4) [irq/181-iwlwifi] 1911 [k] udp6_gro_receive #b32edb1f390ffff8ca3036e3c80 (skb ffff8ca325f87900)
87+ 2606:4700:4700::1111.53 > [redacted].43366 ttl 54 label 0xfe6f0 len 79 proto UDP (17) len 71
88+ ns 0x1/4026531840 if 4 (wlp82s0)
89+
90+ 12313364141628 (4) [irq/181-iwlwifi] 1911 [k] udp_gro_receive #b32edb1f390ffff8ca3036e3c80 (skb ffff8ca325f87900)
91+ 2606:4700:4700::1111.53 > [redacted].43366 ttl 54 label 0xfe6f0 len 79 proto UDP (17) len 71
92+ ns 0x1/4026531840 if 4 (wlp82s0)
93+
94+ 12313364143661 (4) [irq/181-iwlwifi] 1911 [tp] net:netif_receive_skb #b32edb1f390ffff8ca3036e3c80 (skb ffff8ca325f87900)
95+ 2606:4700:4700::1111.53 > [redacted].43366 ttl 54 label 0xfe6f0 len 79 proto UDP (17) len 71
96+ ns 0x1/4026531840 if 4 (wlp82s0)
97+
98+ 12313364186036 (4) [irq/181-iwlwifi] 1911 [k] udpv6_rcv #b32edb1f390ffff8ca3036e3c80 (skb ffff8ca325f87900)
99+ 2606:4700:4700::1111.53 > [redacted].43366 ttl 54 label 0xfe6f0 len 79 proto UDP (17) len 71
100+ ns 0x1/4026531840 if 4 (wlp82s0) rxif 4
101+ ct_state REPLY status 0x18a udp orig [[redacted].43366 > 2606:4700:4700::1111.53] reply [2606:4700:4700::1111.53 > [redacted].43366] zone 0 mark 0
88102```
89103
90104When storing events for later post-processing, the packets' journeys can be
@@ -94,23 +108,35 @@ reconstructed:
94108$ retis -p generic collect -f 'udp port 53 and host 2606:4700:4700::1111' -o \
95109 --cmd 'dig redhat.com @2606:4700:4700::1111'
96110$ retis sort
97- 6946866196800 (11) [isc-net-0000] 23898/23899 [k] ip6_output #651717df140ffff93bc89dd7c00 (skb ffff93bc8c491500) n 0
98- [redacted].54205 > 2606:4700:4700::1111.53 ttl 64 label 0x86973 len 59 proto UDP (17) len 51
99- ↳ 6946866208851 (11) [isc-net-0000] 23898/23899 [tp] net:net_dev_queue #651717df140ffff93bc89dd7c00 (skb ffff93bc8c491500) n 1
100- if 4 (wlp82s0) [redacted].54205 > 2606:4700:4700::1111.53 ttl 64 label 0x86973 len 59 proto UDP (17) len 51
101- ↳ 6946866211760 (11) [isc-net-0000] 23898/23899 [tp] net:net_dev_start_xmit #651717df140ffff93bc89dd7c00 (skb ffff93bc8c491500) n 2
102- if 4 (wlp82s0) [redacted].54205 > 2606:4700:4700::1111.53 ttl 64 label 0x86973 len 59 proto UDP (17) len 51
103-
104- 6946876837639 (7) [irq/187-iwlwifi] 1361 [tp] net:napi_gro_receive_entry #65172204f07ffff93bc93bf6580 (skb ffff93c01ebd8f00) n 0
105- if 4 (wlp82s0) 2606:4700:4700::1111.53 > [redacted].54205 ttl 54 label 0x7ff08 len 79 proto UDP (17) len 71
106- ↳ 6946876842090 (7) [irq/187-iwlwifi] 1361 [k] udp6_gro_receive #65172204f07ffff93bc93bf6580 (skb ffff93c01ebd8f00) n 1
107- if 4 (wlp82s0) 2606:4700:4700::1111.53 > [redacted].54205 ttl 54 label 0x7ff08 len 79 proto UDP (17) len 71
108- ↳ 6946876843587 (7) [irq/187-iwlwifi] 1361 [k] udp_gro_receive #65172204f07ffff93bc93bf6580 (skb ffff93c01ebd8f00) n 2
109- if 4 (wlp82s0) 2606:4700:4700::1111.53 > [redacted].54205 ttl 54 label 0x7ff08 len 79 proto UDP (17) len 71
110- ↳ 6946876845210 (7) [irq/187-iwlwifi] 1361 [tp] net:netif_receive_skb #65172204f07ffff93bc93bf6580 (skb ffff93c01ebd8f00) n 3
111- if 4 (wlp82s0) 2606:4700:4700::1111.53 > [redacted].54205 ttl 54 label 0x7ff08 len 79 proto UDP (17) len 71
112- ↳ 6946876855603 (7) [irq/187-iwlwifi] 1361 [k] udpv6_rcv #65172204f07ffff93bc93bf6580 (skb ffff93c01ebd8f00) n 4
113- if 4 (wlp82s0) rxif 4 2606:4700:4700::1111.53 > [redacted].54205 ttl 54 label 0x7ff08 len 79 proto UDP (17) len 71
111+ 12510323851756 (1) [isc-net-0000] 27137/27138 [k] ip6_output #b60c968c1ecffff8ca27999de40 (skb ffff8ca325f86100) n 0
112+ [redacted].46050 > 2606:4700:4700::1111.53 ttl 64 label 0xa92bf len 59 proto UDP (17) len 51
113+ ns 0x1/4026531840
114+ ct_state NEW status 0x100 udp orig [[redacted].46050 > 2606:4700:4700::1111.53] reply [2606:4700:4700::1111.53 > [redacted].46050] zone 0 mark 0
115+ ↳ 12510323863992 (1) [isc-net-0000] 27137/27138 [tp] net:net_dev_queue #b60c968c1ecffff8ca27999de40 (skb ffff8ca325f86100) n 1
116+ [redacted].46050 > 2606:4700:4700::1111.53 ttl 64 label 0xa92bf len 59 proto UDP (17) len 51
117+ ns 0x1/4026531840 if 4 (wlp82s0)
118+ ct_state NEW status 0x188 udp orig [[redacted].46050 > 2606:4700:4700::1111.53] reply [2606:4700:4700::1111.53 > [redacted].46050] zone 0 mark 0
119+ ↳ 12510323867976 (1) [isc-net-0000] 27137/27138 [tp] net:net_dev_start_xmit #b60c968c1ecffff8ca27999de40 (skb ffff8ca325f86100) n 2
120+ [redacted].46050 > 2606:4700:4700::1111.53 ttl 64 label 0xa92bf len 59 proto UDP (17) len 51
121+ ns 0x1/4026531840 if 4 (wlp82s0)
122+ ct_state NEW status 0x188 udp orig [[redacted].46050 > 2606:4700:4700::1111.53] reply [2606:4700:4700::1111.53 > [redacted].46050] zone 0 mark 0
123+
124+ 12510336743330 (0) [irq/177-iwlwifi] 1907 [tp] net:napi_gro_receive_entry #b60ca2d77a2ffff8ca2fcc582c0 (skb ffff8ca303bd0c00) n 0
125+ 2606:4700:4700::1111.53 > [redacted].46050 ttl 54 label 0xc8017 len 79 proto UDP (17) len 71
126+ ns 0x1/4026531840 if 4 (wlp82s0)
127+ ↳ 12510336748601 (0) [irq/177-iwlwifi] 1907 [k] udp6_gro_receive #b60ca2d77a2ffff8ca2fcc582c0 (skb ffff8ca303bd0c00) n 1
128+ 2606:4700:4700::1111.53 > [redacted].46050 ttl 54 label 0xc8017 len 79 proto UDP (17) len 71
129+ ns 0x1/4026531840 if 4 (wlp82s0)
130+ ↳ 12510336750432 (0) [irq/177-iwlwifi] 1907 [k] udp_gro_receive #b60ca2d77a2ffff8ca2fcc582c0 (skb ffff8ca303bd0c00) n 2
131+ 2606:4700:4700::1111.53 > [redacted].46050 ttl 54 label 0xc8017 len 79 proto UDP (17) len 71
132+ ns 0x1/4026531840 if 4 (wlp82s0)
133+ ↳ 12510336752512 (0) [irq/177-iwlwifi] 1907 [tp] net:netif_receive_skb #b60ca2d77a2ffff8ca2fcc582c0 (skb ffff8ca303bd0c00) n 3
134+ 2606:4700:4700::1111.53 > [redacted].46050 ttl 54 label 0xc8017 len 79 proto UDP (17) len 71
135+ ns 0x1/4026531840 if 4 (wlp82s0)
136+ ↳ 12510336766269 (0) [irq/177-iwlwifi] 1907 [k] udpv6_rcv #b60ca2d77a2ffff8ca2fcc582c0 (skb ffff8ca303bd0c00) n 4
137+ 2606:4700:4700::1111.53 > [redacted].46050 ttl 54 label 0xc8017 len 79 proto UDP (17) len 71
138+ ns 0x1/4026531840 if 4 (wlp82s0) rxif 4
139+ ct_state REPLY status 0x18a udp orig [[redacted].46050 > 2606:4700:4700::1111.53] reply [2606:4700:4700::1111.53 > [redacted].46050] zone 0 mark 0
114140```
115141
116142Retis offers many more features including retrieving [ conntrack
0 commit comments