Network probe manager

Network probe manager tracks incoming and outgoing network packets in a system (packet information as interpret by the bpf module in AIX®). Probe specification allows the user to specify Berkeley Packet Filter (BPF) filters, similar to tcpdump filter expression for granular tracking.

You can use built-in variables to collect packet header and payload information for Internet protocols. For example, Ethernet, Internet Protocol Version 4/Version 6 (IPv4/v6), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), Internet Group Message Protocol (IGMP), and Address Resolution Protocol (ARP) protocols.

Network probe manager reports critical protocol-specific events (TCP state changes, round-trip times, retransmissions, UDP buffer overflows).

The network probe manager addresses following primary use cases:

• Provide the following packet-specific information according to the bpf module based on IP address and ports:
  • Track the incoming and outgoing bytes for a connection.
  • Use following built-ins to gather protocol header and payload information.
    • TCP flags (SYN, FIN), TCP sequence and acknowledgment number.
    • IPv4/IPv6 (IP addresses, protocol types: tcp, udp, icmp, igmp, and so on).
    • ICMP (packet type: ECHO REQUEST, ECHO RESPONSE, and so on).
• Provide access to complete RAW network packet for probe script processing.
• Report the following protocol-related events:
  • Track TCP sender and receiver buffer full events.
  • TCP connection state changes from SYN-SENT state to ESTABLISHED state or from ESTABLISHED state to CLOSE state.
  • Monitor delta time between state changes (for example, time that is taken from SYN-SENT state to ESTABLISHED state).
  • Identify the listener (connection information) that discarded connections because the listener's queue is full.
  • Identify retransmissions (second and further retransmission for a packet) for TCP connections.
  • Identify the UDP socket that dropped packets because of insufficient receiving buffer.

Probe specification

Probe specification for network probe manager contains three or five tuples that are separated by : (colon). First tuple is always @@net.

Network probe manager supports two major categories of specifications: One category gathers packet-specific information and another category gathers protocol-specific information.

• Format to gather packet specific information:

  @@net:bpf:<interface1>|<interface 2>|…..:<protocol>:<Filter>

• Format to gather protocol specific information

  @@net:tcp:<event_name>

  @@net:udp:<event_name>

Probe sub type

The second tuple signifies the sub type of the probe that indicates which layer of AIX network stack contains the probe. This tuple can have one of the following values (it cannot be *):

Probe network event or gather network packet information

The third tuple is specific to particular sub type (specified in second tuple). It cannot have a value of *.

bpf-based probes

The specification contains 5 tuples for bpf-based probes that are described in the following table:

1. Specification format to access the built-in variables that are related to Ethernet header (__etherhdr), IP header(__ip4hdr) or (__ip6hdr), and TCP header (__tcphdr) information from the Vue script when interface en0 receives or sends packet on port 23 (filter string ” port 23”):

   @@net:bpf:en0:tcp:“port 23”

2. Specification format to access the built-in variables related to Ethernet header(__etherhdr), IP header(__ip4hdr or __ip6hdr), and UDP header (__udphdr) information from the Vue script when system receives or sends packet from host example.com (filter string “example.com”) on en0 and en1 interfaces:

   @@net:bpf:en0|en1:udp:“host example.com”

3. Specification format to access the raw packet information when system receives or sends packet from or to "host example.com":

   @@net:bpf:en1:*:“host example.com”

Example

VUE script to access the raw packet data when the “*” is specified as the protocol.

 /* Define the ether header structure */
struct  ether_header {
        char  ether_dhost[6];
        char  ether_shost[6];
        short ether_type;
};

/* ProbeVue script to access and interpret the data from RAW packet */

@@net:bpf:en0:*:"port 23"
{
        /* define the script local variables */
        __auto struct ether_header eth;
        __auto char *mb;

        /* __mdata contains the address of packet data */
        mb =(char *) __mdata;
        printf("Network probevue\n");
        
       /* 
        * Use already available “copy_kdata(…)” VUE function to copy data of 
        * requested size (size of ether_header) from mbuf data pointer to eth
        * (ether_header) variable.
        */
        copy_kdata (mb, eth);
        printf("Ether Type  from raw data :%x\n",eth.ether_type);
      
}

TCP probes

The specification contains three tuples for TCP probes as described in the following table:

__proto_info built-in variable provides the TCP connection (four tuple) information (local IP, remote IP, local port, and remote port) whenever the TCP-related event occurs. Remote port and IP address contains a value of NULL for the listen_q_full event.

Example

Probe specifications for TCP protocol state changes:

@@net:tcp:state_change

udp probes

For udp probes the specification contains three tuples as described in the following table:

The __proto_info built-in variable provides the UDP protocol related data (source IP and destination IP addresses, source and destination port numbers) whenever socket receive buffer overflow event occurs.

@@net:udp:sock_recv_buf_overflow

Example

Probe specifications for UDP socket’s receive buffer overflow:

@@net:udp:sock_recv_buf_overflow

Network probe-related built-in variables for Vue scripts

Network related events can be probed using following built-in variables.

__etherhdr built-in variable

The __etherhdr variable is a special built-in variable to get ether header information from filtered packet. This built-in variable is available when you probe the packet information at interface layer with any one of these protocols: “ether”, “ipv4”, “ipv6”, “tcp”, “udp”, “icmp4”, icmp6”, “igmp”, “arp”, and “rarp”. This variable is available in probes of sub type bpf. Its member elements can be accessed by using the syntax __etherhdr->member.

The __etherhdr built-in value has the following members:

The __ip4hdr variable is a special built-in variable to get the IPv4 header information from filtered packet. This variable is available when you probe the packet information at interface layer with any one of the protocols: “ipv4”,“tcp”, “udp”, “icmp4”, and “igmp”. And, it has valid data when IP version is IPv4. This variable is available in probes of sub type bpf. Its member elements can be accessed by using the syntax __ip4hdr->member.

This built-in variable has the following members:

IPPROTO_HOPOPTS,
IPPROTO_ICMP, 
IPPROTO_IGMP,
IPPROTO_TCP, 
IPPROTO_UDP, 
IPPROTO_ROUTING,
IPPROTO_FRAGMENT, 
IPPROTO_NONE, 
IPPROTO_LOCAL

__ip6hdr built-in variable

The __ip6hdr variable is a special built-in variable to get the IPv6 header information from filtered packet. This variable is available when user probes the packet information at interface layer. This variable with any one of the protocols (“ipv6”, “tcp”, “udp” and “icmp6”) has valid data when IP version is IPv6. This variable is available in probes of sub type bpf. Its member elements can be accessed by using the syntax __ip6hdr->member.

This built-in variable has the following members:

__tcphdr built-in variable

The __tcphdr variable is a special built-in variable to get the tcp header information from filtered packet. This variable is available when you probe the packet information at interface layer with tcp protocol. It is available in probes of sub type bpf. Its member elements can be accessed by using the syntax __tcphdr->member.

The __tcphdr built-in variable has the following members:

__udphdr built-in variable

The __udphdr is a special built-in variable that is used to get the udp header information from filtered packet. This built-in is available when user probes the packet information at interface layer with udp as protocol. It is available in probes of sub type bpf. Its member elements can be accessed by using the syntax __udphdr->member.

__udphdr built-in variable has the following members:

__icmp built-in variable

The __icmp is a special built-in variable that is used to get the icmp header information from filtered packet. This built-in is available when user probes the packet information at interface layer with icmp protocol. It is available in probes of sub type bpf. Its member elements can be accessed by using the syntax __icmp->member.

This built-in variable has the following members:

ICMP_ECHOREPLY, 
ICMP_UNREACH
ICMP_SOURCEQUENCH,
ICMP_REDIRECT,
ICMP_ECHO, 
ICMP_TIMXCEED,
ICMP_PARAMPROB,
ICMP_TSTAMP,
ICMP_TSTAMPREPLY,
ICMP_IREQ, 
ICMP_IREQREPLY,
ICMP_MASKREQ,
ICMP_MASKREPLY

ICMP_REDIRECT_NET 
ICMP_REDIRECT_HOST 
ICMP_REDIRECT_TOSNET 
ICMP_REDIRECT_TOSHOST

ICMP_TIMXCEED_INTRANS
ICMP_TIMXCEED_REASS

__icmp6 built-in variable

__icmp6 is a special built-in variable that is used to get the icmpv6 header information from filtered packet. This is available when user probes the packet information at interface layer with icmp6 protocol. It is available in probes of sub type bpf. Member elements of this built-in variable can be accessed using syntax “__icmp6->member”.

__icmp6 has the following members:

ICMP6_DST_UNREACH
ICMP6_PACKET_TOO_BIG
ICMP6_TIME_EXCEEDED
ICMP6_PARAM_PROB
ICMP6_INFOMSG_MASK
ICMP6_ECHO_REQUEST
ICMP6_ECHO_REPLY 

ICMP6_DST_UNREACH_NOROUTE
ICMP6_DST_UNREACH_ADMIN
ICMP6_DST_UNREACH_ADDR
ICMP6_DST_UNREACH_BEYONDSCOPE
ICMP6_DST_UNREACH_NOPORT

__igmp built-in variable

__igmp is a special built-in variable that is used to get the igmp header information from filtered packet. This is available when user probes the packet information at interface layer with igmp protocol. This is available in probes of sub type bpf. Its member elements can be accessed using syntax “__igmp->member”.

__igmp built-in has the following members:

IGMP_HOST_MEMBERSHIP_QUERY
IGMP_HOST_MEMBERSHIP_REPORT
IGMP_DVMRP
IGMP_HOST_NEW_MEMBERSHIP_REPORT
IGMP_HOST_LEAVE_MESSAGE
IGMP_HOST_V3_MEMBERSHIP_REPORT
IGMP_MTRACE
IGMP_MTRACE_RESP
IGMP_MAX_HOST_REPORT_DELAY

DVMPP_PROBE           1
DVMRP_REPORT          2
DVMRP_ASK_NEIGHBORS   3
DVMRP_ASK_NEIGHBORS2  4
DVMRP_NEIGHBORS       5
DVMRP_NEIGHBORS2      6
DVMRP_PRUNE           7
DVMRP_GRAFT           8
DVMRP_GRAFT_ACK       9
DVMRP_INFO_REQUEST    10
DVMRP_INFO_REPLY      11

__arphdr built-in variable

The __arphdr variable is a special built-in variable that is used to get the arphdr header information from filtered packet. This variable is available when user probes the packet information at interface layer with arp or rarp protocol. It is available in probes of sub type bpf.The __arphdr member elements can be accessed by using the syntax __arphdr->member.

The __arphdr built-in variable has following members:

ARPHRD_ETHER, 
ARPHRD_802_5, 
ARPHRD_802_3, and 
ARPHRD_FDDI

SNAP_TYPE_IP, 
SNAP_TYPE_AP, 
SNAP_TYPE_ARP,
VLAN_TAG_TYPE

ARPOP_REQUEST,
ARPOP_REPLY 

Example

Vue script to probe packet header information for packets received or sent over port 23. Provides the source and destination node information and also tcp header length information

@@net:bpf:en0:tcp:"port 23"
{
        printf("src_addr:%I and dst_addr:%I\n",__ip4hdr->src_addr,__ip4hdr->dst_addr);
        printf("src port:%d\n",__tcphdr->src_port);
        printf("dst port:%d\n",__tcphdr->dst_port);
        printf("tcp hdr_len:%d\n",__tcphdr->hdr_len);
}

Output:
# probevue bpf_tcp.e
src_addr:10.10.10.12 and dst_addr:10.10.18.231
src port:48401
dst port:23
tcp hdr_len:20
..................
.................

__proto_info built-in variable

The __proto_info variable is a special built-in variable that is used to get the protocol (source and destination IP addresses and ports) information for TCP or UDP events. The __proto_info variable is available in probes of sub type tcp or udp. Its member elements can be accessed by using the syntax __proto_info->member.

The __proto_info built-in variable has the following members:

Additional information for TCP-specific events

The TCP state change events are described in the following table:

Example:

The following Vue script provides state change information for a particular connection:

@@net:tcp:state_change
when(__proto_info->local_addr ==”10.10.10.1” and __proto_info->remote_addr == 10.10.10.2”
	and __proto_info->local_port =”8000” and  __proto_info->remote_port =”9000”)
{
	printf(“Previous state:%d and current_state:%d\n”,__prev_state,__cur_state);
}

TCP retransmit event

Examples

1. Following example Identifies the listener which has discarded connections due to listener's queue is full.

@@net:tcp:listen_q_full
{
	printf(“Listener IP address:%I and Port number is:%d\n”,__proto_info->local_addr, __proto_info->local_port);
}

2. Following example Identifies connection which drop packets due to socket buffer overflows

@@net:udp:sock_recv_buf_overflow
{
        printf("Connection information which drops packet due to socket buffer overflows:\n"); 
        printf("Local IP address:%I and Remote IP address:%I\n",__proto_info->local_addr,__proto_info->remote_addr);
        printf("local port :%d and remote port:%d\n",__proto_info->local_port, __proto_info->remote_port);
 }

3. Identify retransmissions (second & further retransmission for a packet) for TCP connections for particular connection.

@@net:tcp:retransmit
when (__proto_info->local_addr == "10.10.10.1" &&
 	__proto_info->remote_addr == "10.10.10.2" && 
__proto_info->local_port == "4000" &&
 	__proto_info->remote_port == "5000")
{
        printf(" %d th re-transmition for this connection\n", _nth_retransmit);
}

4. Identify the connection information whenever sender buffer full event occurs .

@@net:tcp:send_buf_full
{
        printf("Connection information whenever send buffer full event occurs:\n"); 
        printf("Local IP address:%I and Remote IP address:%I\n",__proto_info->local_addr,__proto_info->remote_addr);
        printf("local port :%d and remote port:%d\n",__proto_info->local_port, __proto_info->remote_port);
 }