KSNOOP(8) KSNOOP(8)

# [NAME](#NAME)

KSNOOP - tool for tracing kernel function entry/return showing arguments/return values

# [SYNOPSIS](#SYNOPSIS)

**ksnoop** \[*OPTIONS*] { *COMMAND* *FUNC* | **help** }

*OPTIONS* := { { **-V** | **--version** } | { **-h** | **--help** } | { \[**-P** | **--pages**] nr\_pages} | { \[**-p** | **--pid**] pid} | \[{ **-s** | **--stack** }] | \[{ **-d** | **--debug** }] }

*COMMAND* := { **trace** | **info** }

*FUNC* := { **name** | **name**(**arg**\[,\*\*arg]) }

# [DESCRIPTION](#DESCRIPTION)

*ksnoop* allows for inspection of arguments and return values associated with function entry/return.

[**ksnoop info *FUNC***](#ksnoop)

Show function description, arguments and return value types.

[**ksnoop trace *FUNC* \[*FUNC*\]**](#ksnoop~2)

Trace function entry and return, showing arguments and return values. A function name can simply be specified, or a function name along with named arguments, return values. **return** is used to specify the return value.

*ksnoop* requires the kernel to provide BTF for itself, and if tracing of module data is required, module BTF must be present also. Check /sys/kernel/btf to see if BTF is present.

**ksnoop** requires *CAP\_BPF* and *CAP\_TRACING* capabilities.

# [OPTIONS](#OPTIONS)

[**-h*,* --help**](#h)

Show help information

[**-V, --version**](#V)

Show version.

[**-d, --debug**](#d)

Show debug output.

[**-p, --pid**](#p)

Filter events by pid.

[**-P, --pages**](#P)

Specify number of pages used per-CPU for perf event collection. Default is 8.

[**-s, --stack**](#s)

Specified set of functions are traced if and only if they are encountered in the order specified.

# [EXAMPLES](#EXAMPLES)

**# ksnoop info ip\_send\_skb**

```
int  ip_send_skb(struct net  * net, struct sk_buff  * skb);
```

Show function description.

**# ksnoop trace ip\_send\_skb**

```


          TIME  CPU      PID FUNCTION/ARGS
78101668506811    1     2813 ip_send_skb(


                                 net = *(0xffffffffb5959840)


                                  (struct net){


                                   .passive = (refcount_t){


                                    .refs = (atomic_t){


                                     .counter = (int)0x2,


                                    },


                                   },


                                   .dev_base_seq = (unsigned int)0x18,


                                   .ifindex = (int)0xf,


                                   .list = (struct list_head){


                                    .next = (struct list_head *)0xffff9895440dc120,


                                    .prev = (struct list_head *)0xffffffffb595a8d0,


                                   },


                                 ...
79561322965250    1     2813 ip_send_skb(


                                 return =


                                  (int)0x0


                             );
```

Show entry/return for ip\_send\_skb() with arguments, return values.

**# ksnoop trace "ip\_send\_skb(skb)"**

```


         TIME  CPU      PID FUNCTION/ARGS
78142420834537    1     2813 ip_send_skb(


                                 skb = *(0xffff989750797c00)


                                  (struct sk_buff){


                                   (union){


                                    .sk = (struct sock *)0xffff98966ce19200,


                                    .ip_defrag_offset = (int)0x6ce19200,


                                   },


                                   (union){


                                    (struct){


                                     ._skb_refdst = (long unsigned int)0xffff98981dde2d80,


                                     .destructor = (void (*)(struct sk_buff *))0xffffffffb3e1beb0,


                                    },


                                ...
```

Show entry argument **skb**.

**# ksnoop trace "ip\_send\_skb(return)"**

```


         TIME  CPU      PID FUNCTION/ARGS
78178228354796    1     2813 ip_send_skb(


                                 return =


                                  (int)0x0


                             );
```

Show return value from ip\_send\_skb().

**# ksnoop trace "ip\_send\_skb(skb->sk)"**

```


          TIME  CPU      PID FUNCTION/ARGS
78207649138829    2     2813 ip_send_skb(


                                 skb->sk = *(0xffff98966ce19200)


                                  (struct sock){


                                   .__sk_common = (struct sock_common){


                                    (union){


                                     .skc_addrpair = (__addrpair)0x1701a8c017d38f8d,


                                     (struct){


                                      .skc_daddr = (__be32)0x17d38f8d,


                                      .skc_rcv_saddr = (__be32)0x1701a8c0,


                                     },


                                    },


                                  ...
```

Trace member information associated with argument. Only one level of membership is supported.

**# ksnoop -p 2813 "ip\_rcv(dev)"**

```


          TIME  CPU      PID FUNCTION/ARGS
78254803164920    1     2813 ip_rcv(


                                 dev = *(0xffff9895414cb000)


                                  (struct net_device){


                                   .name = (char[16])[


                                    'l',


                                    'o',


                                   ],


                                   .name_node = (struct netdev_name_node *)0xffff989541515ec0,


                                   .state = (long unsigned int)0x3,


                                 ...
```

Trace **dev** argument of **ip\_rcv()**. Specify process id 2813 for events for that process only.

**# ksnoop -s tcp\_sendmsg \_\_tcp\_transmit\_skb ip\_output**

```


         TIME  CPU      PID FUNCTION/ARGS
71827770952903    1     4777 __tcp_transmit_skb(


                                 sk = *(0xffff9852460a2300)


                                  (struct sock){


                                   .__sk_common = (struct sock_common){


                                    (union){


                                     .skc_addrpair = (__addrpair)0x61b2af0a35cbfe0a,
```

Trace entry/return of tcp\_sendmsg, \_\_tcp\_transmit\_skb and ip\_output when tcp\_sendmsg leads to a call to \_\_tcp\_transmit\_skb and that in turn leads to a call to ip\_output; i.e. with a call graph matching the order specified. The order does not have to be direct calls, i.e. function A can call another function that calls function B.

**# ksnoop "ip\_send\_skb(skb->len > 100, skb)"**

```


          TIME  CPU      PID FUNCTION/ARGS
39267395709745    1     2955 ip_send_skb(


                                 skb->len =


                                  (unsigned int)0x89,


                                 skb = *(0xffff89c8be81e500)


                                  (struct sk_buff){


                                   (union){


                                    .sk = (struct sock *)0xffff89c6c59e5580,


                                    .ip_defrag_offset = (int)0xc59e5580,


                                   },
```

Trace ip\_send\_skb() skbs which have len > 100.

# [SEE ALSO](#SEE_ALSO)

[**bpf**(2)](/man/enterprise-packages/bcc/bpf.2),

---

Document: ksnoop(8) from bcc 0.37.0-r2 (Chainguard OS)
Source: https://github.com/iovisor/bcc