in bpf/profiling/network/netmonitor.c [159:202]
static __inline void notify_close_connection(struct pt_regs* ctx, __u64 conid, struct active_connection_t* con, __u64 start_time, __u64 end_time) {
// if the connect event not send, then check the pid or socket family
if (con->connect_event_send == false) {
// only trace ipv4, v6, or unknown
if (family_should_trace(con->socket_family) == false) {
return;
}
// ignore send close event if current process should not trace
if (tgid_should_trace(con->pid) == false) {
return;
}
}
__u64 exe_time = (__u64)(end_time - start_time);
struct socket_close_event_t close_event = {};
close_event.conid = conid;
close_event.random_id = con->random_id;
close_event.exe_time = exe_time;
close_event.pid = con->pid;
close_event.sockfd = con->sockfd;
close_event.role = con->role;
close_event.protocol = con->protocol;
close_event.ssl = con->ssl;
close_event.socket_family = con->socket_family;
close_event.local_addr_v4 = con->local_addr_v4;
__builtin_memcpy(&close_event.local_addr_v6, &con->local_addr_v4, 16*sizeof(__u8));
close_event.local_port = con->local_port;
close_event.remote_addr_v4 = con->remote_addr_v4;
__builtin_memcpy(&close_event.remote_addr_v6, &con->remote_addr_v6, 16*sizeof(__u8));
close_event.remote_port = con->remote_port;
close_event.write_bytes = con->write_bytes;
close_event.write_count = con->write_count;
close_event.write_exe_time = con->write_exe_time;
close_event.read_bytes = con->read_bytes;
close_event.read_count = con->read_count;
close_event.read_exe_time = con->read_exe_time;
close_event.write_rtt_count = con->write_rtt_count;
close_event.write_rtt_time = con->write_rtt_time;
bpf_perf_event_output(ctx, &socket_close_event_queue, BPF_F_CURRENT_CPU, &close_event, sizeof(close_event));
}