ENV:
Ubuntu 20.04:
root@bpf1:~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.3 LTS
Release: 20.04
Codename: focal
root@bpf1:~# uname -a
Linux bpf1 5.11.0-051100-generic #202102142330 SMP Sun Feb 14 23:33:21 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
root@bpf1:~#
使用apt install安装的时候,通常不一定能符合我们的需求,所以需要安装对应的版本,以下内容均是为cilium 中pwru的项目准备。
https://github.com/cilium/pwru
Go >= 1.16
LLVM/clang >= 1.12
1.Go安装:
登录Go官网,选择对应的需要的版本下载,这里以1.17.6为例:
wget https://go.dev/dl/go1.17.6.linux-amd64.tar.gz
tar -xvf go1.17.6.linux-amd64.tar.gz
mv go /usr/local/
vi ~/.profile # add export PATH=$PATH:/usr/local/go/bin
source ~/.profile
root@bpf1:~# go version
go version go1.17.6 linux/amd64
root@bpf1:~#
2.LLVM 和 clang安装:
https://zhuanlan.zhihu.com/p/102028114
sudo mkdir -p /usr/local
cd /usr/local
sudo wget https://github.com/llvm/llvm-project/releases/download/llvmorg-13.0.0/clang+llvm-13.0.0-x86_64-linux-gnu-ubuntu-20.04.tar.xz
sudo tar xvf clang+llvm-13.0.0-x86_64-linux-gnu-ubuntu-20.04.tar.xz
sudo mv clang+llvm-13.0.0-x86_64-linux-gnu-ubuntu-20.04 llvm
export PATH="$PATH:/usr/local/llvm/bin"
root@bpf1:~/pwru# clang --version
clang version 13.0.0 (https://github.com/llvm/llvm-project/ 24c8eaec9467b2aaf70b0db33a4e4dd415139a50)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/local/llvm/bin
root@bpf1:~/pwru#
[x] 1.pwru编译安装 ```properties 由于https://github.com/cilium/pwru 提供的版本中,获取pagesize以后是通过syscall的方式,但是默认的ubuntu 20.04上的pagesize是4096.所以当抓包的时候,会有丢包:https://github.com/cilium/pwru/issues/46 this issue: 所以我们需要重新自己编译一下pwru: 具体的修改位置: https://github.com/cilium/pwru/blob/ad9a560f99a45ce2115b3a622f625c377bfe43be/main.go#L145
log.Printf(“Attached (ignored %d)\n”, ignored)
// rd, err := perf.NewReader(events, os.Getpagesize()) rd, err := perf.NewReader(events, 16384) if err != nil {
log.Fatalf("Creating perf event reader: %s", err)
}
具体参考https://github.com/cilium/pwru/issues/46。
然后:再重新build一下pwru。[当前版本:v0.0.3]
root@bpf1:~/pwru# ./pwru -h Usage of ./pwru: —filter-dst-ip string filter destination IP addr —filter-dst-port uint16 filter destination port —filter-func string filter kernel functions to be probed by name (exact match, supports RE2 regular expression) —filter-mark uint32 filter skb mark —filter-netns uint32 filter netns inode —filter-proto string filter L4 protocol (tcp, udp, icmp, icmp6) —filter-src-ip string filter source IP addr —filter-src-port uint16 filter source port —output-limit-lines uint exit the program after the number of events has been received/printed —output-meta print skb metadata —output-relative-timestamp print relative timestamp per skb —output-skb print skb —output-stack print stack —output-tuple print L4 tuple —version show pwru version and exit pflag: help requested root@bpf1:~/pwru# ```