kenny/spotdl-auto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed the bpftrace invocation

Browse Source
This commit is contained in:
kenny
2025-11-21 21:48:38 +02:00
parent bb3efb1cca
commit 2d560efd2f
1 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
dns-debunk.sh
View File

@@ -1,5 +1,5 @@
#!/usr/bin/env bash #!/usr/bin/env bash
# dns_bpf_correlate_fixed.sh # dns_bpf_correlate_safe.sh
set -u set -u
DOMAIN=$1 DOMAIN=$1
@@ -40,14 +40,12 @@ tcpdump -n -i any port 53 -s0 -ttt -l 2>/dev/null >> "$DNSLOG" &
TCPDUMP_PID=$! TCPDUMP_PID=$!
echo -e "${GREEN}[*] tcpdump started (PID $TCPDUMP_PID)${RESET}" echo -e "${GREEN}[*] tcpdump started (PID $TCPDUMP_PID)${RESET}"
# Start bpftrace inline (correct syntax) # Start bpftrace (safe, prints nsecs/1000000, PID, COMM, FD)
bpftrace -e ' bpftrace -e '
tracepoint:syscalls:sys_enter_sendto tracepoint:syscalls:sys_enter_sendto
{ {
$s = time; $ms = nsecs/1000000 % 1000; printf("%d PID=%d COMM=%s FD=%d\n", nsecs/1000000, pid, comm, args->fd);
printf("%d.%03d PID=%d COMM=%s FD=%d\n", $s, $ms, pid, comm, args->fd); }' > "$BPFLOG" 2>/dev/null &
}
' > "$BPFLOG" 2>/dev/null &
BPF_PID=$! BPF_PID=$!
sleep 0.2 sleep 0.2
@@ -97,15 +95,14 @@ tail -Fn0 "$DNSLOG" | while IFS= read -r dnsline; do
echo "extracted_src_port: $srcPort" >> "$INCIDENT_FILE" echo "extracted_src_port: $srcPort" >> "$INCIDENT_FILE"
fi fi
# Symmetric window: half before, half after # Symmetric window: ±HALF_WINDOW_MS
low_ms=$((detect_ms - HALF_WINDOW_MS)) low_ms=$((detect_ms - HALF_WINDOW_MS))
high_ms=$((detect_ms + HALF_WINDOW_MS)) high_ms=$((detect_ms + HALF_WINDOW_MS))
awk -v low="$low_ms" -v high="$high_ms" ' awk -v low="$low_ms" -v high="$high_ms" '
BEGIN{FS=" "; OFS=" "} BEGIN{FS=" "; OFS=" "}
{ {
if ($1 ~ /^[0-9]+\.[0-9]{3}$/) { if ($1 ~ /^[0-9]+$/) {
split($1, a, ".") t=$1;
t_s=a[1]; t_ms=a[2]; t=t_s*1000+t_ms
if (t >= low && t <= high) print $0 if (t >= low && t <= high) print $0
} }
}' "$BPFLOG" | tee -a "$INCIDENT_FILE" > /tmp/_bpf_matches.$$ || true }' "$BPFLOG" | tee -a "$INCIDENT_FILE" > /tmp/_bpf_matches.$$ || true