Commit 1a5090a5 authored by Brendan Gregg's avatar Brendan Gregg

tcpdrop: reduce data struct size

parent b2b98712
......@@ -52,29 +52,28 @@ BPF_STACK_TRACE(stack_traces, 1024);
// separate data structs for ipv4 and ipv6
struct ipv4_data_t {
// XXX: switch some to u32's when supported
u64 pid;
u32 pid;
u64 ip;
u64 saddr;
u64 daddr;
u64 sport;
u64 dport;
u64 state;
u64 tcpflags;
u64 stack_id;
u16 sport;
u16 dport;
u8 state;
u8 tcpflags;
u32 stack_id;
};
BPF_PERF_OUTPUT(ipv4_events);
struct ipv6_data_t {
u64 pid;
u32 pid;
u64 ip;
unsigned __int128 saddr;
unsigned __int128 daddr;
u64 sport;
u64 dport;
u64 state;
u64 tcpflags;
u64 stack_id;
u16 sport;
u16 dport;
u8 state;
u8 tcpflags;
u32 stack_id;
};
BPF_PERF_OUTPUT(ipv6_events);
......@@ -152,28 +151,28 @@ if debug or args.ebpf:
# event data
class Data_ipv4(ct.Structure):
_fields_ = [
("pid", ct.c_ulonglong),
("pid", ct.c_ulong),
("ip", ct.c_ulonglong),
("saddr", ct.c_ulonglong),
("daddr", ct.c_ulonglong),
("sport", ct.c_ulonglong),
("dport", ct.c_ulonglong),
("state", ct.c_ulonglong),
("tcpflags", ct.c_ulonglong),
("stack_id", ct.c_ulonglong)
("sport", ct.c_ushort),
("dport", ct.c_ushort),
("state", ct.c_ubyte),
("tcpflags", ct.c_ubyte),
("stack_id", ct.c_ulong)
]
class Data_ipv6(ct.Structure):
_fields_ = [
("pid", ct.c_ulonglong),
("pid", ct.c_ulong),
("ip", ct.c_ulonglong),
("saddr", (ct.c_ulonglong * 2)),
("daddr", (ct.c_ulonglong * 2)),
("sport", ct.c_ulonglong),
("dport", ct.c_ulonglong),
("state", ct.c_ulonglong),
("tcpflags", ct.c_ulonglong),
("stack_id", ct.c_ulonglong)
("sport", ct.c_ushort),
("dport", ct.c_ushort),
("state", ct.c_ubyte),
("tcpflags", ct.c_ubyte),
("stack_id", ct.c_ulong)
]
# process event
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment