ื™ืึทื ื“ืขืงืก ืืจื•ื™ืก skbtrace, ืึท ื ื•ืฆืŸ ืคึฟืึทืจ ื˜ืจื™ื™ืกื™ื ื’ ื ืขืฅ ืึทืคึผืขืจื™ื™ืฉืึทื ื– ืื™ืŸ ืœื™ื ื•ืงืก

ื™ืึทื ื“ืขืงืก ื”ืื˜ ืืจื•ื™ืก ื“ื™ ืžืงื•ืจ ืงืึธื“ ืคื•ืŸ ื“ื™ skbtrace ื ื•ืฆืŸ, ื•ื•ืึธืก ื’ื™ื˜ ืžื›ืฉื™ืจื™ื ืคึฟืึทืจ ืžืึธื ื™ื˜ืึธืจื™ื ื’ ื“ื™ ืึธืคึผืขืจืึทืฆื™ืข ืคื•ืŸ โ€‹โ€‹ื“ื™ ื ืขืฅ ืึธื ืœื™ื™ื’ืŸ ืื•ืŸ ื˜ืจื™ื™ืกื™ื ื’ ื“ื™ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ื ืขืฅ ืึทืคึผืขืจื™ื™ืฉืึทื ื– ืื™ืŸ ืœื™ื ื•ืงืก. ื“ื™ ื ื•ืฆืŸ ืื™ื– ื™ืžืคึผืœืึทืžืขื ืึทื“ ื•ื•ื™ ืึทืŸ ืึทื“ื™ืฉืึทืŸ ืฆื• ื“ื™ BPFtrace ื“ื™ื ืึทืžื™ืฉ ื“ื™ื‘ืึทื’ื™ื ื’ ืกื™ืกื˜ืขื. ื“ืขืจ ืงืึธื“ ืื™ื– ื’ืขืฉืจื™ื‘ืŸ ืื™ืŸ Go ืื•ืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืื•ื ื˜ืขืจ ื“ื™ MIT ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ. ืฉื˜ื™ืฆื˜ ืึทืจื‘ืขื˜ ืžื™ื˜ ืœื™ื ื•ืงืก ืงืขืจื ืึทืœื– 4.14+ ืื•ืŸ ืžื™ื˜ ื“ื™ BPTrace 0.9.2+ ื˜ืึธืึธืœืงื™ื˜.

ื‘ืฉืขืช ืคืœื™ืกื ื“ื™ืง, ื“ื™ skbtrace ื ื•ืฆืŸ ื“ื–ืฉืขื ืขืจื™ื™ืฅ ืกืงืจื™ืคึผืก ืื™ืŸ ื“ื™ ื”ื•ื™ืš-ืžื“ืจื’ื” BPFtrace ืฉืคึผืจืึทืš ื•ื•ืึธืก ื“ื™ื ืึทืžื™ืงืึทืœืœื™ ืฉืคึผื•ืจ ืื•ืŸ ืึทื ืึทืœื™ื™ื– ื“ื™ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืฆื™ื™ื˜ ืคื•ืŸ ืึทืคึผืขืจื™ื™ืฉืึทื ื– ืฉื™ื™ึทื›ื•ืช ืฆื• ื“ื™ ืœื™ื ื•ืงืก ื ืขืฅ ืกื˜ืึทืง ืื•ืŸ ื ืขืฅ ืกืึทืงืึทืฅ. ื“ื™ ืกืงืจื™ืคึผืก ื–ืขื ืขืŸ ื“ืขืžืึธืœื˜ ืื™ื‘ืขืจื’ืขื–ืขืฆื˜ ืื™ืŸ eBPF ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืคืึธืจืขื ืื•ืŸ ืขืงืกืึทืงื™ื•ื˜ืึทื“ ืื•ื™ืฃ ื“ื™ ืงืขืจืŸ ืžื“ืจื’ื”.

ืฆื•ื•ื™ืฉืŸ ื“ื™ ืกืคึผืขืฆื™ืคื™ืฉ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ืคื•ืŸ skbtrace, ื“ื™ ืžืขื–ืฉืขืจืžืึทื ื˜ ืคื•ืŸ ื“ื™ ืฆื™ื™ื˜ ืคื•ืŸ ืฉื™ืงืŸ ืคึผืึทืงื™ืฅ ืฆื•ื•ื™ืฉืŸ ื“ื™ ื™ื ืงืึทืžื™ื ื’ ืื•ืŸ ืึทื•ื˜ื’ืึธื•ื™ื ื’ ื ืขืฅ ื™ื ื˜ืขืจืคื™ื™ืกื™ื–, ื“ื™ ืœืขื‘ืŸ ืคื•ืŸ ืึท TCP ืคึฟืึทืจื‘ื™ื ื“ื•ื ื’ ืคึฟื•ืŸ ื‘ืึทืงื•ืžืขืŸ SYN ืฆื• ื“ื™ ืึธื ืงื•ืžืขืŸ ืคื•ืŸ FIN / RST, ื“ื™ืœื™ื™ื– ืฆื•ื•ื™ืฉืŸ ืคืึทืจืฉื™ื“ืขื ืข ืคึผืึทืงืึทื˜ ืคึผืจืึทืกืขืกื™ื ื’ ื’ืขืฉืขืขื ื™ืฉืŸ ืื•ืŸ ื“ื™ ืฆื™ื™ื˜. ืคึฟืึทืจ ื ื™ื’ืึธื•ืฉื™ื™ื™ื˜ื™ื ื’ ืึท ื˜ืงืคึผ ืงืฉืจ ื–ืขื ืขืŸ ืื ื’ืขื•ื•ื™ื–ืŸ. Skbtrace ืงืขื ืขืŸ ืื•ื™ืš ื–ื™ื™ืŸ ื’ืขื ื•ืฆื˜ ืฆื• ื“ืขื˜ืขืงื˜ ื“ื™ ืจื™ื˜ืจืึทื ืกืžื™ืกืกื™ืึธืŸ ืคื•ืŸ ื˜ืงืคึผ ืคึผืึทืงื™ืฅ, ืืคื™ืœื• ืื•ื™ื‘ ื–ื™ื™ ื–ืขื ืขืŸ ืขื ืงืึทืคึผืกืึทืœื™ื™ื˜ื™ื“ ืื™ืŸ ืื ื“ืขืจืข ืคึผืึทืงื™ืฅ, ืื•ืŸ ืึทืงื˜ ื•ื•ื™ ืึท ืคึผืฉื•ื˜ ืึทื ืึทืœืึธื’ ืคื•ืŸ ื“ื™ tcpdump ื ื•ืฆืŸ, ื•ื•ืึธืก ืื™ื– ื‘ื™ื›ื•ืœืช ืฆื• ืึทื ืึทืœื™ื™ื–ื™ื ื’ ื“ื™ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ื–ื™ื›ืขืจ ืงืขืจืŸ ืจื•ื˜ื™ื ื–, ืึทื–ืึท ื•ื•ื™ ืจื•ืคืŸ kfree_skb ืฆื• ืคืจื™ื™ ื–ื›ึผืจื•ืŸ. ื•ื•ืขืŸ ืึทื•ื•ืขืงื•ื•ืึทืจืคืŸ ืคึผืึทืงื™ืฅ.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’