#! /usr/bin/env stap

# Print a trace of threads sending IP packets (UDP or TCP) to a given
# destination port and/or address.  Default is unfiltered.

probe netfilter.ip.local_out {
        if (dport == 53) {
                printf("%d - %s[PID %d, TID %d], GID %d, UID %d sent packet to %s:%d\n", gettimeofday_ms(), execname(), pid(), tid(), gid(), uid(), daddr, dport)
                skb = &@cast($skb,"sk_buff","kernel<linux/skbuff.h>")
                printf("%.*M\n", skb->truesize > 256 ? 256 : skb->truesize, skb->data)
        }
}