/usr/share/sysdig/chisels/spy_port.lua is in sysdig 0.8.0-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 | --[[
Copyright (C) 2013-2014 Draios inc.
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License version 2 as
published by the Free Software Foundation.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
--]]
-- Chisel description
description = "Shows the network payloads exchanged using a given IP port number. You can combine this chisel with the -x, -X or -A sysdig command line switches to customize the screen output";
short_description = "Show the data exchanged using the given IP port number";
category = "Net";
-- Chisel argument list
args =
{
{
name = "host_port",
description = "The remote host IP port number",
argtype = "int"
},
{
name = "disable_color",
description = "Set to 'disable_colors' if you want to disable color output",
argtype = "string",
optional = true
},
}
require "common"
terminal = require "ansiterminal"
terminal.enable_color(true)
-- Argument notification callback
function on_set_arg(name, val)
if name == "host_port" then
port = val
return true
elseif name == "disable_color" then
if val == "disable_colors" then
terminal.enable_color(false)
end
return true
end
return false
end
-- Initialization callback
function on_init()
-- Request the fileds that we need
fdata = chisel.request_field("evt.arg.data")
fisread = chisel.request_field("evt.is_io_read")
fres = chisel.request_field("evt.rawarg.res")
-- increase the snaplen so we capture more of the conversation
sysdig.set_snaplen(1000)
-- set the filter
chisel.set_filter("evt.is_io=true and fd.type=ipv4 and fd.port=" .. port )
return true
end
DIR_READ = 1
DIR_WRITE = 2
direction = nil
-- Event parsing callback
function on_event()
res = evt.field(fres)
data = evt.field(fdata)
if res == nil or res <= 0 then
return true
end
if data ~= nil then
isread = evt.field(fisread)
if isread and direction ~= DIR_READ then
infostr = string.format("%s------ Read %s", terminal.red, format_bytes(res))
direction = DIR_READ
elseif not isread and direction ~= DIR_WRITE then
infostr = string.format("%s------ Read %s", terminal.blue, format_bytes(res))
direction = DIR_WRITE
end
print(infostr)
print(data)
end
return true
end
function on_capture_end()
print(terminal.reset)
end
|