Welcome to BCC Discussions!

[chenhengqi]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

[tahirali-csc]

In tcplife.bpf.c, when reading ip4/pi6 source/dest addresses

bcc/libbpf-tools/tcplife.bpf.c

Line 138 in 8422cd4

bpf_probe_read_kernel(&event.saddr, sizeof(args->saddr), BPF_CORE_READ(args, saddr));

, we use bpf_probe_read_kernel instead of bpf_core_read. The whole purpose of bpf_core_read is that handles fields offset changes transparently across different kernel version. Any thoughts?

[chenhengqi]

Please open a new discussion.