Quick Start

const char *BPF_PROGRAM = R"(
#include <uapi/linux/ptrace.h>
#include <linux/tcp.h>
#include <net/sock.h>
#include <bcc/proto.h>

BPF_HASH(birth, struct sock *, u64);

struct event_t {
    u64 EventTime;
    u64 ts_us;
    u32 pid;
    u32 uid;
    unsigned __int128 saddr;
    unsigned __int128 daddr;
    u64 rx_b;
    u64 tx_b;
    u32 tcpi_segs_out;
    u32 tcpi_segs_in;
    u64 span_us;
    u16 family;
    u16 SPT;
    u16 DPT;
    char task[TASK_COMM_LEN];
};

BPF_PERF_OUTPUT(tcpEvents);

struct id_t {
    u32 pid;
    u32 uid;
    char task[128];
};
BPF_HASH(whoami, struct sock *, struct id_t);

int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state) {
    u32 pid = bpf_get_current_pid_tgid() >> 32;
    u32 uid = bpf_get_current_uid_gid() & 0xffffffff;

    u16 lport = sk->__sk_common.skc_num;
    u16 dport = sk->__sk_common.skc_dport;

    // Track connection birth time
    if (state < TCP_FIN_WAIT1) {
        u64 ts = bpf_ktime_get_ns();
        birth.update(&sk, &ts);
    }

    // Store process info on connection initiation
    if (state == TCP_SYN_SENT || state == TCP_LAST_ACK) {
        struct id_t me = {.pid = pid, .uid = uid};
        bpf_get_current_comm(&me.task, sizeof(me.task));
        whoami.update(&sk, &me);
    }

    // Capture event on connection close
    if (state != TCP_CLOSE)
        return 0;

    // Calculate connection lifespan
    u64 *tsp = birth.lookup(&sk);
    if (tsp == 0) {
        whoami.delete(&sk);
        return 0;
    }
    u64 delta_us = (bpf_ktime_get_ns() - *tsp) / 1000;
    birth.delete(&sk);

    struct id_t *mep = whoami.lookup(&sk);
    if (mep != 0) {
        pid = mep->pid;
        uid = mep->uid;
    }

    // Populate event structure
    struct event_t event = {0};
    struct tcp_sock *tp = (struct tcp_sock *)sk;
    event.rx_b = tp->bytes_received;
    event.tx_b = tp->bytes_acked;
    event.tcpi_segs_out = tp->data_segs_out;
    event.tcpi_segs_in = tp->data_segs_in;
    event.family = sk->__sk_common.skc_family;

    // Handle IPv4 and IPv6 addresses
    if (event.family == AF_INET) {
        event.saddr = sk->__sk_common.skc_rcv_saddr;
        event.daddr = sk->__sk_common.skc_daddr;
    } else if (event.family == AF_INET6) {
        bpf_probe_read(&event.saddr, sizeof(event.saddr),
            sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
        bpf_probe_read(&event.daddr, sizeof(event.daddr),
            sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32);
    }

    event.EventTime = bpf_ktime_get_ns();
    event.uid = uid;
    event.pid = pid;
    event.SPT = lport;
    event.DPT = ntohs(dport);

    if (mep == 0) {
        bpf_get_current_comm(&event.task, sizeof(event.task));
    } else {
        bpf_probe_read(&event.task, sizeof(event.task), (void *)mep->task);
    }

    if (event.family) {
        tcpEvents.perf_submit(ctx, &event, sizeof(event));
    }

    if (mep != 0) {
        whoami.delete(&sk);
    }

    return 0;
}
)";

void (*cleanup)();

void signalHandler(int signum) {
    printf("Shutting down...\n");
    cleanup();
    exit(signum);
}

int main() {
    // Load the shared library
    void *handle = dlopen(SOFILE, RTLD_LAZY);
    if (!handle) {
        fprintf(stderr, "Failed to load library: %s\n", dlerror());
        exit(EXIT_FAILURE);
    }

    // Resolve symbols
    void (*AddProbe)(const char*) = dlsym(handle, "AddProbe");
    struct tcp_event_t (*DequeuePerfEvent)() = dlsym(handle, "DequeuePerfEvent");
    cleanup = dlsym(handle, "cleanup");
    unsigned (*getStatus)() = dlsym(handle, "getStatus");

    if (!AddProbe || !DequeuePerfEvent || !cleanup || !getStatus) {
        fprintf(stderr, "Failed to resolve symbols: %s\n", dlerror());
        exit(EXIT_FAILURE);
    }

    // Set up signal handler
    signal(SIGINT, signalHandler);

    // Load the eBPF program
    printf("Loading eBPF probe...\n");
    AddProbe(BPF_PROGRAM);

    // Wait for probe to be ready
    while (!getStatus()) {
        printf("Waiting for probe initialization...\n");
        sleep(1);
    }

    printf("Monitoring TCP connections (press Ctrl+C to exit)...\n");

    // Event processing loop
    while (1) {
        struct tcp_event_t event = DequeuePerfEvent();

        // Print event details
        printf("\n--- TCP Connection Closed ---\n");
        printf("Process: %s (PID: %u, UID: %u)\n",
               event.task, event.pid, event.UserId);
        printf("Endpoints: %s:%u -> %s:%u\n",
               event.SADDR, event.SPT, event.DADDR, event.DPT);
        printf("Traffic: RX=%lu bytes, TX=%lu bytes\n",
               event.rx_b, event.tx_b);
        printf("Segments: IN=%u, OUT=%u\n",
               event.tcpi_segs_in, event.tcpi_segs_out);
        printf("Timestamp: %lu ns\n", event.EventTime);
    }

    dlclose(handle);
    return 0;
}