bpfsnoop
A modernized kernel functions, kernel tracepoints and bpf programs tracing tool for the bpf era.
Advanced features
Trace kernel with ease.
Trace kernel functions with
Trace kernel tracepoints with
Trace kernel bpf programs with
Output Last Branch Record (LBR) for each tracee
Filter kernel functions with glob, arguments name w/ or w/o arguments type
Filter kernel tracepoints with glob, arguments name w/ or w/o arguments type
Filter bpf programs with glob, arguments name w/ or w/o arguments type, ids, tags, pid, etc.
Output function stack for each tracee
Output typed arguments and typed return value for each tracee
Filter arguments' attributes with C expression
Output arguments' attributes with C expression
Output flame graph of function stack
Filter packets with pcap-filter(7) if tracee has skb or xdp argument
Output packets' tuple info if tracee has skb or xdp argument