No saddr, daddr, dport for udp.recvmsg, udp.sendmsg

[Frank Ch. Eigler]

az1029az1029az wrote:

(Wow, that's a mouthful!)

> [...]
> probe udp.recvmsg, udp.sendmsg  {
>   printf(" %15s %15s  %5d  %5d  \n",
>          saddr, daddr, sport, dport)
> }
>
> and most of the time only sport has a correct value while dport is 0
> and saddr and daddr are 0.0.0.0. [...]

I'm seeing similar behaviour here on Fedora 22 (kernel 4.3-ish).  It
appears that the incoming $sk, in its inet_sock cast, sometimes passes
within the kernel without that data.  For example, I get 0.0.0.0 IP
addresses for some broadcast traffic such as mdns / rwho.

Does this match your observations?  Are you sure there is a problem?

Compare also to this script, which operates at a different layer in the
kernel:

probe netfilter.ipv*.* {
    if (protocol==ipproto_udp)
        printd(" ", pp(), saddr, sport, daddr, dport, "\n") 
}


- FChE