No saddr, daddr, dport for udp.recvmsg, udp.sendmsg

AZX AMN az1029az1029az@gmail.com
Fri Feb 26 21:19:00 GMT 2016


> I'm seeing similar behaviour here on Fedora 22 (kernel 4.3-ish).  It
> appears that the incoming $sk, in its inet_sock cast, sometimes passes
> within the kernel without that data.  For example, I get 0.0.0.0 IP
> addresses for some broadcast traffic such as mdns / rwho.
>
> Does this match your observations?  Are you sure there is a problem?
>

I'm seeing this for regular unicast traffic although it does seem to
depend on the application. For example traffic of the OpenVPN
application always has only sport and so do DNS lookups from nslookup.
However lookups from dnsmasq have both saddr and sport (and still no
daddr or dport) and the same goes for ntp. Traffic from netcat ("nc -u
...") shows all fields properly.

> Compare also to this script, which operates at a different layer in the
> kernel:
>
> probe netfilter.ipv*.* {
>     if (protocol==ipproto_udp)
>         printd(" ", pp(), saddr, sport, daddr, dport, "\n")
> }

Indeed, this shows it all properly. But shouldn't recvmsg and sendmsg
also do it for normal unicast traffic?



More information about the Systemtap mailing list