Method generateDropTracepoint

shell/tracescript.go:100–160

generateDropTracepoint creates the kfree_skb tracepoint for packet drops.

()

// generateDropTracepoint creates the kfree_skb tracepoint for packet drops.
func (g *ScriptGenerator) generateDropTracepoint() string {
	var sb strings.Builder

	// Tracepoint for packet drops
	// Note: No pre-filter here because we need to parse skb to get IPs.
	// IP filtering is done in the body after extracting addresses.
	sb.WriteString("tracepoint:skb:kfree_skb\n")
	sb.WriteString("{\n")

	// Extract packet info
	sb.WriteString(`    $skb = (struct sk_buff *)args->skbaddr;
    $reason = args->reason;

    // Skip non-drop events (reason 0-2 are not real drops)
    if ($reason <= 2) { return; }

    $protocol = $skb->protocol;

    // Only process IPv4 for now
    if (bswap($protocol) != 0x0800) { return; }

    $iph = (struct iphdr *)($skb->head + $skb->network_header);
    $saddr_raw = $iph->saddr;
    $daddr_raw = $iph->daddr;
    $saddr = ntop(2, $saddr_raw);
    $daddr = ntop(2, $daddr_raw);
    $ipproto = $iph->protocol;

`)

	// Add IP/CIDR filter inside the body if specified
	ipFilter := g.buildSkbIPFilterCondition()
	if ipFilter != "" {
		sb.WriteString(ipFilter)
	}

	sb.WriteString(`    $sport = (uint16)0;
    $dport = (uint16)0;

    // Extract ports for TCP/UDP
    if ($ipproto == 6 || $ipproto == 17) {
        $transport_off = $skb->transport_header;
        if ($transport_off > 0 && $transport_off < 65535) {
            $th = $skb->head + $transport_off;
            $sport = bswap(*(uint16*)($th));
            $dport = bswap(*(uint16*)($th + 2));
        }
    }

`)

	// Generate output based on format
	if g.config.OutputJSON {
		sb.WriteString(g.generateJSONOutput())
	} else {
		sb.WriteString(g.generateTableOutput())
	}