tcp_v4_hnd_req()查找或者创建客户端的sock结构
inet_csk_search_req()查找连接请求结构
tcp_check_req()创建代表客户端的sock结构, 将连接请求链入到这个sock结构的接收队列中
inet_lookup_established()在已经连接的sock队列中查找sock结构
tcp_rcv_state_process()根据服务器sock状态对数据包进行处理
tcp_v4_syn_recv_sock()复制服务器的sock结构用于客户端的连接操作
tcp_create_openreq_child()克隆服务器的sock结构, 创建客户端的sock
tcp_child_process()唤醒服务器进程处理连接请求.
tcp_rcv_state_process()根据客户端sock状态处理数据包

1.客户端TCP建链发送SYN完成后将tcp状态从CLOSE设为SYN_SENT*/

发送SYN

#static int tcp_v4_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
echo 'p:tcp_v4_connect tcp_v4_connect sk=%di srcip=+0x4(%di):x32 dstip=+0x4(%si):x32 srcport=+0x378(%di):x16 dstport=+0x2(%si):x16 skc_state=+0x12(%di):x8 sk_drops=+0xa8(%di):x32 sk_flags=+0x60(%di):x32 daddr=+0x4(%si):x32 dport=+0x2(%si):x16 prevfunc=$stack0' >/sys/kernel/debug/tracing/kprobe_events

#int tcp_connect(struct sock *sk)
echo 'p:tcp_connect tcp_connect sk=%di srcip=+0x4(%di):x32 dstip=+0x0(%di):x32 srcport=+0x378(%di):x16 dstport=+0xc(%di):x16 sk_bound_dev_if=+0x14(%di):x32 skc_state=+0x12(%di):x8 sk_drops=+0xa8(%di):x32 sk_flags=+0x60(%di):x32 prevfunc=$stack0' >/sys/kernel/debug/tracing/kprobe_events


#2.服务端TCP建链收到SYN 
#回复SYN+ACK
#int tcp_v4_rcv(struct sk_buff *skb)
echo 'p:tcp_v4_rcv tcp_v4_rcv skd=%di srcip=-0x8(+0xe8(%di)):x32 dstip=-0x4(+0xe8(%di)):x32 srcport=+0x0(+0xe8(%di)):x16 dstport=+0x2(+0xe8(%di)):x16 ip_len=-0x18(+0xe8(%di)):x16 version=-0x20(+0xe8(%di)):x16 tcp_seq=+0x4(+0xe8(%di)):x32 tcp_ack=+0x8(+0xe8(%di)):x32 tcp_flags=+0xc(+0xe8(%di)):x16 tcp_win=+0xe(+0xe8(%di)):x16 tcp_check=+0x10(+0xe8(%di)):x16 devname=+0x0(+0x10(%di)):string skb_pttype=+0x80(%di):b3@0/8 skb_iff=+0x90(%di):x32 skc_csumvaild=+0x81(%di):b1@7/8 skb_scumcompletesw=+0x82(%di):b1@0/8 skb_users=+0xf4(%di):x32' >>/sys/kernel/debug/tracing/kprobe_events

echo 'r:__inet_lookup_listener_r __inet_lookup_listener ret=$retval' >>/sys/kernel/debug/tracing/kprobe_events
echo 'ret==0' >>/sys/kernel/debug/tracing/events/kprobes/__inet_lookup_listener_r/filter

echo 'r:tcp_filter_r tcp_filter ret=$retval' >>/sys/kernel/debug/tracing/kprobe_events
echo 'ret!=0' >>/sys/kernel/debug/tracing/events/kprobes/tcp_filter_r/filter

echo 'srcport==0xb822||dstport==0xb822' >/sys/kernel/debug/tracing/events/kprobes/tcp_v4_do_rcv/filter

#int tcp_child_process(struct sock *parent, struct sock *child, struct sk_buff *skb)
echo 'p:tcp_child_process tcp_child_process parent=%di child=%si skb=%dx srcip=-8(+0xe8(%dx)):x32 dstip=-4(+0xe8(%dx)):x32 srcport=+0x0(+0xe8(%dx)):x16 dstport=+0x2(+0xe8(%dx)):x16 child_sk_locl_owned=+0x8c(+0xe8(%dx)):x32 prevfunc=$stack0' >/sys/kernel/debug/tracing/kprobe_events

echo 'p:tcp_v4_do_rcv tcp_v4_do_rcv sk=%di skb=%si version=-20(+0xe8(%si)):b4@4/32 skc_state=+0x12(%di):x8 sk_drops=+0xa8(%di):x32 sk_flags=+0x60(%di):x32 rcv_nxt=+0x650(%di):x32 copied_seq=+0x654(%di):x32 srcip=-8(+0xe8(%si)):x32 dstip=-4(+0xe8(%si)):x32 srcport=+0x0(+0xe8(%si)):x16 dstport=+0x2(+0xe8(%si)):x16 ip_len=-18(+0xe8(%si)):x16 ip_id=-16(+0xe8(%si)):x16 tcp_seq=+0x4(+0xe8(%si)):x32 tcp_ack=+0x8(+0xe8(%si)):x32 tcp_flags=+0xc(+0xe8(%si)):x16 tcp_win=+0xe(+0xe8(%si)):x16 tcp_check=+0x10(+0xe8(%si)):x16 skb_len=+0x70(%si):x32 skb_datalen=+0x74(%si):x32 skb_users=+0xf4(%si):x32 cb_seq=+0x28(%si):x32 cb_seq_end=+0x2c(%si):x32 prevfunc=$stack0' >/sys/kernel/debug/tracing/kprobe_events

#int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
echo 'p:tcp_rcv_state_process tcp_rcv_state_process sk=%di skb=%si version=-20(+0xe8(%si)):b4@4/32 skc_state=+0x12(%di):x8 sk_drops=+0xa8(%di):x32 sk_flags=+0x60(%di):x32 rcv_nxt=+0x650(%di):x32 copied_seq=+0x654(%di):x32 srcip=-0x8(+0xe8(%si)):x32 dstip=-4(+0xe8(%si)):x32 srcport=+0x0(+0xe8(%si)):x16 dstport=+0x2(+0xe8(%si)):x16 ip_len=-18(+0xe8(%si)):x16 ip_id=-16(+0xe8(%si)):x16 tcp_seq=+0x4(+0xe8(%si)):x32 tcp_ack=+0x8(+0xe8(%si)):x32 tcp_flags=+0xc(+0xe8(%si)):x16 tcp_win=+0xe(+0xe8(%si)):x16 tcp_check=+0x10(+0xe8(%si)):x16 skb_len=+0x70(%si):x32 skb_datalen=+0x74(%si):x32 skb_users=+0xf4(%si):x32 cb_seq=+0x28(%si):x32 cb_seq_end=+0x2c(%si):x32 prevfunc=$stack0' >/sys/kernel/debug/tracing/kprobe_events

#static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, const struct tcphdr *th)

echo 'p:tcp_rcv_synsent_state_process tcp_rcv_synsent_state_process sk=%di skb=%si version=-20(+0xe8(%si)):b4@4/32 skc_state=+0x12(%di):x8 sk_drops=+0xa8(%di):x32 sk_flags=+0x60(%di):x32 rcv_nxt=+0x650(%di):x32 copied_seq=+0x654(%di):x32 srcip=-0x8(+0xe8(%si)):x32 dstip=-4(+0xe8(%si)):x32 srcport=+0x0(+0xe8(%si)):x16 dstport=+0x2(+0xe8(%si)):x16 ip_len=-18(+0xe8(%si)):x16 ip_id=-16(+0xe8(%si)):x16 tcp_seq=+0x4(+0xe8(%si)):x32 tcp_ack=+0x8(+0xe8(%si)):x32 tcp_flags=+0xc(+0xe8(%si)):x16 tcp_win=+0xe(+0xe8(%si)):x16 tcp_check=+0x10(+0xe8(%si)):x16 skb_len=+0x70(%si):x32 skb_datalen=+0x74(%si):x32 skb_users=+0xf4(%si):x32 cb_seq=+0x28(%si):x32 cb_seq_end=+0x2c(%si):x32 prevfunc=$stack0' >/sys/kernel/debug/tracing/kprobe_events

#int tcp_conn_request(struct request_sock_ops *rsk_ops, const struct tcp_request_sock_ops *af_ops, struct sock *sk, struct sk_buff *skb)
echo 'p:tcp_conn_request tcp_conn_request sk=%dx skb=%cx version=-20(+0xe8(%cx)):b4@4/32 sk_srcip=+0x4(%dx):x32 sk_dstip=+0x0(%dx):x32 sk_srcport=+0x378(%dx):x16 sk_dstport=+0xc(%dx):x16 skc_state=+0x12(%dx):x8 sk_drops=+0xa8(%dx):x32 request_sock_queue_qlen=+0x454(%dx):x32 request_sock_queue_yuoung=+0x458(%dx):x32 sk_max_ack_backlog=+0x264(%dx):x16 srcip=-0x8(+0xe8(%cx)):x32 dstip=-4(+0xe8(%cx)):x32 srcport=+0x0(+0xe8(%cx)):x16 dstport=+0x2(+0xe8(%cx)):x16 ip_len=-18(+0xe8(%cx)):x16 ip_id=-16(+0xe8(%cx)):x16 tcp_seq=+0x4(+0xe8(%cx)):x32 tcp_ack=+0x8(+0xe8(%cx)):x32 tcp_flags=+0xc(+0xe8(%cx)):x16 tcp_win=+0xe(+0xe8(%cx)):x16 tcp_check=+0x10(+0xe8(%cx)):x16 skb_len=+0x70(%cx):x32 skb_datalen=+0x74(%cx):x32 skb_users=+0xf4(%cx):x32 cb_seq=+0x28(%cx):x32 cb_seq_end=+0x2c(%cx):x32 prevfunc=$stack0' >/sys/kernel/debug/tracing/kprobe_events


#static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst,struct flowi *fl,struct request_sock *req,struct tcp_fastopen_cookie *foc,enum tcp_synack_type synack_type,struct sk_buff *syn_skb)
echo 'r:tcp_v4_send_synack tcp_v4_send_synack ret=$retval >/sys/kernel/debug/tracing/kprobe_events
echo 'ret!=0' >>/sys/kernel/debug/tracing/events/kprobes/tcp_v4_send_synack/filter

3.客户端收到SYN+ACK 回复ack确认

#void tcp_close(struct sock *sk, long timeout)
echo 'p:tcp_close tcp_close sk=%di timout=%si srcip=+0x4(%di):x32 dstip=+0x0(%di):x32 srcport=+0x378(%di):x16 dstport=+0xc(%di):x16 skc_state=+0x12(%di):x8 sk_drops=+0xa8(%di):x32 sk_flags=+0x60(%di):x32 sk_lingertime=+0x240(%di):x64 sk_err=+0x258(%di):x32 rcv_nxt=+0x650(%di):x32 copied_seq=+0x654(%di):x32 request_sock_queue_qlen=+0xec(%di):x32 sk_backing_rmem_alloc=+0xe8(%di):x32 prevfunc=$stack0' >/sys/kernel/debug/tracing/kprobe_events


echo 'p:tcp_fin tcp_fin sk=%di srcip=+0x4(%di):x32 dstip=+0x0(%di):x32 srcport=+0x378(%di):x16 dstport=+0xc(%di):x16 skc_state=+0x12(%di):x8 sock_flags=+0x8(+0x2a0(%di)):x32 sk_flags=+0x60(%di):x32 rcv_nxt=+0x650(%di):x32 copied_seq=+0x654(%di):x32 prevfunc=$stack0' >/sys/kernel/debug/tracing/kprobe_events

#发送ack

echo 'p:__tcp_send_ack __tcp_send_ack sk=%di srcip=+0x4(%di):x32 dstip=+0x0(%di):x32 srcport=+0x378(%di):x16 dstport=+0xc(%di):x16 skc_state=+0x12(%di):x8 sock_flags=+0x8(+0x2a0(%di)):x32 sk_flags=+0x60(%di):x32 rcv_nxt=+0x650(%di):x32 copied_seq=+0x654(%di):x32 prevfunc=$stack0' >>/sys/kernel/debug/tracing/kprobe_events


echo 'p:tcp_send_fin  tcp_send_fin sk=%di srcip=+0x4(%di):x32 dstip=+0x0(%di):x32 srcport=+0x378(%di):x16 dstport=+0xc(%di):x16 skc_state=+0x12(%di):x8 sock_flags=+0x8(+0x2a0(%di)):x32 sk_flags=+0x60(%di):x32 rcv_nxt=+0x650(%di):x32 copied_seq=+0x654(%di):x32 prevfunc=$stack0' >>/sys/kernel/debug/tracing/kprobe_events