#! /usr/bin/env stap

# Print a trace of threads sending IP packets (UDP or TCP) to a given
# destination port and/or address.  Default is unfiltered.

probe netfilter.ip.local_out {
        if (dport == 53)
                printf("%d - %s[PID %d, TID %d], GID %d, UID %d sent packet to %s:%d\n", gettimeofday_ms(), execname(), pid(), tid(), gid(), uid(), daddr, dport);
                printf("%.*M", buf_len, buffer_base);
}



gave this result;



# stap -v who_sent_it.stp
Pass 1: parsed user script and 116 library scripts using 233768virt/36872res/7284shr/29456data kb, in 150usr/30sys/185real ms.
WARNING: never-assigned local variable 'buf_len' (similar: fin, syn, nf_stolen, pf, ack): identifier 'buf_len' at who_sent_it.stp:9:18
 source:                printf("%.*M", buf_len, buffer_base);
                                       ^
WARNING: never-assigned local variable 'buffer_base' (similar: ack, outdev_name, psh, rst, indev_name): identifier 'buffer_base' at :9:27
 source:                printf("%.*M", buf_len, buffer_base);
                                                ^
WARNING: never-assigned local variable 'buf_len' (similar: fin, syn, nf_stolen, pf, ack): identifier 'buf_len' at :9:18
 source:                printf("%.*M", buf_len, buffer_base);
                                       ^
WARNING: never-assigned local variable 'buffer_base' (similar: ack, outdev_name, psh, rst, indev_name): identifier 'buffer_base' at :9:27
 source:                printf("%.*M", buf_len, buffer_base);
                                                ^
Pass 2: analyzed script: 5 probes, 21 functions, 9 embeds, 3 globals using 242884virt/48140res/11780shr/36476data kb, in 460usr/2260sys/2738real ms.
Missing separate debuginfos, use: debuginfo-install kernel-core-4.4.6-301.fc23.x86_64
Pass 3: translated to C into "/tmp/stapJrRfBf/stap_f361a3bafe1d8e172bb7796474795a39_28715_src.c" using 242884virt/48140res/11780shr/36476data kb, in 10usr/0sys/8real ms.
Pass 4: compiled C into "stap_f361a3bafe1d8e172bb7796474795a39_28715.ko" in 3320usr/750sys/3886real ms.
Pass 5: starting run.
ERROR: read fault [man error::fault] at 0x          (null) ((((unsigned char *)(ptr)))) near identifier 'buf_len' at who_sent_it.stp:9:18
WARNING: Number of errors: 1, skipped probes: 0
WARNING: /usr/bin/staprun exited with status: 1
Pass 5: run completed in 0usr/30sys/1059real ms.
Pass 5: run failed.  [man error::pass5]