record real packet size

mozillazg · Apr 21, 2024 · f9bbd57 · f9bbd57
1 parent d4511b3
commit f9bbd57
Show file tree

Hide file tree

Showing 5 changed files with 14 additions and 5 deletions.
diff --git a/bpf/bpf_x86_bpfel.go b/bpf/bpf_x86_bpfel.go
diff --git a/bpf/bpf_x86_bpfel.o b/bpf/bpf_x86_bpfel.o
diff --git a/bpf/ptcpdump.c b/bpf/ptcpdump.c
@@ -77,6 +77,7 @@ struct packet_event_meta_t {
     u32 ifindex;
     u32 pid;
     u64 payload_len;
+    u64 packet_size;
     char comm[TASK_COMM_LEN];
 };
 
@@ -400,6 +401,7 @@ static __always_inline int handle_tc(struct __sk_buff *skb, bool egress) {
     __builtin_memcpy(&event->meta.comm, &value->comm, sizeof(value->comm));
 
     u64 payload_len = (u64)skb->len;
+    event->meta.packet_size = payload_len;
     payload_len = payload_len < MAX_PAYLOAD_SIZE ? payload_len : MAX_PAYLOAD_SIZE;
     event->meta.payload_len = payload_len;
 

diff --git a/internal/event/net.go b/internal/event/net.go
@@ -17,10 +17,12 @@ const (
 )
 
 type Packet struct {
-	Type   packetType
-	Device dev.Device
-	Pid    int
-	Comm   string
+	Type      packetType
+	Device    dev.Device
+	Pid       int
+	Comm      string
+	Truncated bool
+	Len       int
 
 	Data []byte
 }
@@ -38,6 +40,10 @@ func ParsePacketEvent(devices map[int]dev.Device, rawSample []byte) (*Packet, er
 	if event.Meta.PacketType == 1 {
 		p.Type = packetTypeEgress
 	}
+	if event.Meta.PacketSize > event.Meta.PayloadLen {
+		p.Truncated = true
+	}
+	p.Len = int(event.Meta.PacketSize)
 	p.Device = devices[int(event.Meta.Ifindex)]
 	p.Data = make([]byte, event.Meta.PayloadLen)
 	copy(p.Data[:], event.Payload[:event.Meta.PayloadLen])

diff --git a/internal/writer/pcapng.go b/internal/writer/pcapng.go
@@ -25,7 +25,7 @@ func (w *PcapNGWriter) Write(e *event.Packet) error {
 	info := gopacket.CaptureInfo{
 		Timestamp:      time.Now(),
 		CaptureLength:  payloadLen,
-		Length:         payloadLen,
+		Length:         e.Len,
 		InterfaceIndex: e.Device.Ifindex,
 	}
 	p := w.pcache.Get(e.Pid)