On Wed, Oct 23, 2024 at 8:59 PM Menglong Dong [off-list ref] wrote:

On Wed, Oct 23, 2024 at 8:33 PM Yafang Shao [off-list ref] wrote:

quoted

We previously hooked the tcp_drop_reason() function using BPF to monitor
TCP drop reasons. However, after upgrading our compiler from GCC 9 to GCC
11, tcp_drop_reason() is now inlined, preventing us from hooking into it.
To address this, it would be beneficial to introduce a dedicated tracepoint
for monitoring.

Hello,

Can the existing tracepoint kfree_skb do this work? AFAIK, you
can attach you BPF to the kfree_skb tracepoint and do some filter
according to the "protocol" field, or the information "sk" field. And
this works fine in my tool.

I hope I'm not missing something :/

BTW, I do such filter in probe_parse_skb_sk() in
https://github.com/OpenCloudOS/nettrace/blob/master/shared/bpf/skb_parse.h

We prefer not to hook the kfree_skb tracepoint, as we want to avoid
the overhead of parsing extensive information from @skb. Since we now
have a function that can be easily hooked, why not hook it directly?

--
Regards
Yafang