pwru icon indicating copy to clipboard operation
pwru copied to clipboard

Trace skb with fragments.

Open middaywords opened this issue 1 year ago • 1 comments

Some NIC driver may also put packet header(IP/TCP header) in skb non-linear area(frags). in this case, packet related information(e.g. IP/port) cannot be retrieved from linear data area. bpf_skb_load_bytes() can load packet data in fragments, however, it only works in tc/sk_filter/lwt bpf progs and fail verification in kprobe.

Since pwru use kprobe, do u have any plan or idea about supporting tracing fragmented skb in pwru?

Thanks

middaywords avatar Sep 19 '23 08:09 middaywords

We would need to track fragments in a BPF map. Not sure what an entry function would be good for that. No plans at the moment, but happy to help with such a contribution.

brb avatar Sep 23 '23 07:09 brb