Re: New LTTNG user

Re: New LTTNG user

[Jessica Foest]

[-- Attachment #1.1: Type: text/plain, Size: 424 bytes --]

Hi

when use lttng network tracepoint it didn't display network interface mode
(like promiscuous mode or other ) . did i miss some tracepoint option or
it's a limitation ?
regard


2013/6/26 Jessica Foest <jessica.foest@gmail.com>

> Hi
>
> when use lttng network tracepoint it didn't display network interface mode
> (like promiscuous mode or other ) . did i miss some tracepoint option or
> it's a limitation ?
> regard
>

[-- Attachment #1.2: Type: text/html, Size: 848 bytes --]

[-- Attachment #2: Type: text/plain, Size: 155 bytes --]

_______________________________________________
lttng-dev mailing list
lttng-dev@lists.lttng.org
http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev

Re: New LTTNG user

[Mathieu Desnoyers]

* Jessica Foest (jessica.foest@gmail.com) wrote:
> Hi
> 
> when use lttng network tracepoint it didn't display network interface mode
> (like promiscuous mode or other ) . did i miss some tracepoint option or
> it's a limitation ?

One email was enough.

The more you send emails like this, the longer it will take to get a
reply.

Best regards,

Mathieu

> regard
> 
> 
> 2013/6/26 Jessica Foest <jessica.foest@gmail.com>
> 
> > Hi
> >
> > when use lttng network tracepoint it didn't display network interface mode
> > (like promiscuous mode or other ) . did i miss some tracepoint option or
> > it's a limitation ?
> > regard
> >

> _______________________________________________
> lttng-dev mailing list
> lttng-dev@lists.lttng.org
> http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev


-- 
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com

Re: New LTTNG user

[Geneviève Bastien]

[-- Attachment #1.1: Type: text/plain, Size: 1028 bytes --]

On 06/26/2013 12:58 AM, Jessica Foest wrote:
> Hi
>
> when use lttng network tracepoint it didn't display network interface 
> mode (like promiscuous mode or other ) . did i miss some tracepoint 
> option or it's a limitation ?
> regard
>
>
> _______________________________________________
> lttng-dev mailing list
> lttng-dev@lists.lttng.org
> http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev
Hi Jessica,

Which tracepoints are you using?  If you're talking about net_dev_queue, 
netif_receive_skb, netif_rx, then the information it shows is very 
limited.  I have an experimental branch which adds data to those 
tracepoints, mostly the network header if it's IP or IPv6 and transport 
header if it's TCP.  But the network interface mode is not one of those 
data, though if you know how to find it, it may (or may not) be fairly 
easy to add.

Here's the git branch
http://git.dorsal.polymtl.ca/~gbastien?p=lttng-modules.git;a=summary
branch net_data_experimental

Regards,

Geneviève

[-- Attachment #1.2: Type: text/html, Size: 2065 bytes --]

[-- Attachment #2: Type: text/plain, Size: 155 bytes --]

_______________________________________________
lttng-dev mailing list
lttng-dev@lists.lttng.org
http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev

Re: New LTTNG user

[Matthew Khouzam]

[-- Attachment #1.1: Type: text/plain, Size: 1219 bytes --]

Hi,

Welcome to LTTng-dev.

What distro are you using?

I am looking at the tracepoints, I see system tap has
probe:netdev.set_promiscuity, it's probably not in the default list but
it hooked onto set_promiscuity.

Maybe you can use a kprobe on set_promiscuity and then check later
events to infer if enabled is true. I'm sorry, I work more on the trace
viewing side than the kernel side so my knowledge is rather limited.

Hope this helps and please keep us updated, this is an interesting problem.

Matthew


On 13-06-26 04:14 PM, Jessica Foest wrote:
> Hi
>
> when use lttng network tracepoint it didn't display network interface
> mode (like promiscuous mode or other ) . did i miss some tracepoint
> option or it's a limitation ?
> regard
>
>
> 2013/6/26 Jessica Foest <jessica.foest@gmail.com
> <mailto:jessica.foest@gmail.com>>
>
>     Hi
>
>     when use lttng network tracepoint it didn't display network
>     interface mode (like promiscuous mode or other ) . did i miss some
>     tracepoint option or it's a limitation ?
>     regard
>
>
>
>
> _______________________________________________
> lttng-dev mailing list
> lttng-dev@lists.lttng.org
> http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev


[-- Attachment #1.2: Type: text/html, Size: 2999 bytes --]

[-- Attachment #2: Type: text/plain, Size: 155 bytes --]

_______________________________________________
lttng-dev mailing list
lttng-dev@lists.lttng.org
http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev

Re: New LTTNG user

[Matthew Khouzam]

[-- Attachment #1.1: Type: text/plain, Size: 3555 bytes --]

Hi Jessica,

I am ccing the list because this is relevant and I am hoping someone
yells at me: "No you're wrong!" It's a great way to learn.
On 13-06-28 03:33 PM, Jessica Foest wrote:
> hi Matthew,
> thanks for your response
>
> i'm using ubuntu distribution.
> your solution seems to be a good one but i'm not sure that i
> understand what do you mean by "check later events to infer if enabled
> is true" , can your explain to me how can i do it ?

Ok, you can do it in may ways technically, also I am far from being an
expert on the subject of promiscuity, you may want to consult with
people in security for less  

let's say you have the following events

file_read, net_set_promiscuous, file_read, file_write,
net_copy_whole_packet_to_cpu, file_touch

these are obviously made up events, but it's to give you an idea of
what's going on.

you know the mode is set when net_set_promiscuous is called, you don't
know if it's changed or not, someone can be calling true or false
constantly.
you know that net_copy_whole_packet_to_cpu is only callable when the
card is in promiscuous mode.
let's say there's a second set promiscous mode and nothing saying before
that the card was in promiscuous mode, could it be safe to assume that
it was not?

When you get the second packet, you know the mode.

function receive_event(event event_){
  if( event.is_promiscuous() == true) {
    flags.new_promiscuous_mode = true;
    flags.new_promiscuous_time = event.ts;
  }
  if( event.is_an_event_that_will_only_happen_in_promiscuous_mode() ) {
    if( flags.new_promiscuous_mode == true) {
     flags.new_promiscuous_mode = false;
     flags.promiscuous = true;
    }
  }
}

This is by the way one of the interesting use cases of the state systems
available in eclipse and the awesome LTTv. You read the trace once,
infer more information then the analysis tools will give you pertinent
info, instead of sifting through a detailed events list like this
http://youtu.be/3vAnuBtyEYE.

best regards,

Matthew

>
> regards
>
>
> 2013/6/27 Matthew Khouzam <matthew.khouzam@ericsson.com
> <mailto:matthew.khouzam@ericsson.com>>
>
>     Hi,
>
>     Welcome to LTTng-dev.
>
>     What distro are you using?
>
>     I am looking at the tracepoints, I see system tap has
>     probe:netdev.set_promiscuity, it's probably not in the default
>     list but it hooked onto set_promiscuity.
>
>     Maybe you can use a kprobe on set_promiscuity and then check later
>     events to infer if enabled is true. I'm sorry, I work more on the
>     trace viewing side than the kernel side so my knowledge is rather
>     limited.
>
>     Hope this helps and please keep us updated, this is an interesting
>     problem.
>
>     Matthew
>
>
>     On 13-06-26 04:14 PM, Jessica Foest wrote:
>>     Hi
>>
>>     when use lttng network tracepoint it didn't display network
>>     interface mode (like promiscuous mode or other ) . did i miss
>>     some tracepoint option or it's a limitation ?
>>     regard
>>
>>
>>     2013/6/26 Jessica Foest <jessica.foest@gmail.com
>>     <mailto:jessica.foest@gmail.com>>
>>
>>         Hi
>>
>>         when use lttng network tracepoint it didn't display network
>>         interface mode (like promiscuous mode or other ) . did i miss
>>         some tracepoint option or it's a limitation ?
>>         regard
>>
>>
>>
>>
>>     _______________________________________________
>>     lttng-dev mailing list
>>     lttng-dev@lists.lttng.org <mailto:lttng-dev@lists.lttng.org>
>>     http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev
>
>


[-- Attachment #1.2: Type: text/html, Size: 8280 bytes --]

[-- Attachment #2: Type: text/plain, Size: 155 bytes --]

_______________________________________________
lttng-dev mailing list
lttng-dev@lists.lttng.org
http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev

Re: New LTTNG user

[Jessica Foest]

[-- Attachment #1.1: Type: text/plain, Size: 526 bytes --]

Hi,

i don't see any options in lttng that can list modules loaded into the
kernel .

did you know how to do it ?
regards


2013/7/23 Matthew Khouzam <matthew.khouzam@ericsson.com>

>  Hi Jessica,
>
> I'm sorry, this is more a question for the list.
>
> Off the top of my head, I would say just lsmod from an ssh.
>
> Matt
>
>
>  On 13-07-23 04:26 PM, Jessica Foest wrote:
>
> Hi Matthew,
>
>  i don't see any options in lttng that can list modules loaded into the
> kernel .
>
> did you know how to do it ?
>
> regards
>
>
>

[-- Attachment #1.2: Type: text/html, Size: 1376 bytes --]

[-- Attachment #2: Type: text/plain, Size: 155 bytes --]

_______________________________________________
lttng-dev mailing list
lttng-dev@lists.lttng.org
http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev

New LTTNG user

[Jessica Foest]

[-- Attachment #1.1: Type: text/plain, Size: 179 bytes --]

Hi

when use lttng network tracepoint it didn't display network interface mode
(like promiscuous mode or other ) . did i miss some tracepoint option or
it's a limitation ?
regard

[-- Attachment #1.2: Type: text/html, Size: 256 bytes --]

[-- Attachment #2: Type: text/plain, Size: 155 bytes --]

_______________________________________________
lttng-dev mailing list
lttng-dev@lists.lttng.org
http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev