sure. function was available in /proc/kallsyms.
Any suggestion how to track source IP and natted IP in bpf after NAT
masquerade?
Basically I wanted to know the Source IP and source Port after NAT IP
using 5 tuple lookup?
-- PK
On Tue, Jan 2, 2024 at 8:00 PM Steven Rostedt <rostedt@xxxxxxxxxxx> wrote:
>
> On Tue, 2 Jan 2024 11:23:54 +0530
> P K <pkopensrc@xxxxxxxxx> wrote:
>
> > Hi,
> >
> > I am unable to trace nf_nat functions using kprobe with the latest kernel.
> > Previously in kernel 6.1.55-1 it was working fine.
> > Can someone please check if it's broken with the latest commit or i
> > have to use it differently?
> >
>
> Note, attaching to kernel functions is never considered stable API and may
> break at any kernel release.
>
> Also, if the compiler decides to inline the function, and makes it no
> longer visible in /proc/kallsyms then that too will cause this to break.
>
> -- Steve
>
>
> > Mentioned below are output:
> > Kernel - 6.1.55-1
> > / # bpftrace -e 'kprobe:nf_nat_ipv4_manip_pkt { printf("func called\n"); }'
> > Attaching 1 probe...
> > cannot attach kprobe, probe entry may not exist
> > ERROR: Error attaching probe: 'kprobe:nf_nat_ipv4_manip_pkt'
> >
> >
> >
> > Kernel 6.1.55-1
> > / # bpftrace -e 'kprobe:nf_nat_ipv4_manip_pkt { printf("func called\n"); }'
> > Attaching 1 probe...
> > func called
> > func called
>
