Sample run using hte Mozilla DTrace load-start and load-end probes =================================================================== $ browserspy_uri.d Tracing Browser Network Activity... Hit Ctrl-C to end. ^C URI structure: ://:@://.;?# URI Browser requests by scheme, PID UID COUNT AVG(msec) SUM(msec) SCHEME 2593 65535 1 429 429 file 2593 65535 24 31 755 about 2593 65535 20 452 904 http 2593 65535 1 4443 4443 https URI Browser requests by content type, PID UID COUNT AVG(msec) SUM(msec) CONTENT_TYPE 2593 65535 1 0 0 application/x-unknown-content-type 2593 65535 21 0 0 2593 65535 24 233 6533 text/html URI Browser requests by username (if used), PID UID COUNT AVG(msec) SUM(msec) USERNAME 2593 65535 46 233 6533 URI Browser requests by file extension, PID UID COUNT AVG(msec) SUM(msec) FILE_EXT 2593 65535 1 0 0 jspa 2593 65535 1 0 0 rol 2593 65535 2 0 0 php 2593 65535 3 0 0 idl 2593 65535 35 31 755 2593 65535 3 444 1334 html 2593 65535 1 4443 4443 cgi URI Browser requests by host, PID UID COUNT AVG(msec) SUM(msec) HOST 2593 65535 1 0 0 blog.mozilla.com 2593 65535 1 0 0 docs.sun.com 2593 65535 1 0 0 forums.suselinuxsupport.de 2593 65535 1 0 0 www.abercornbasin.com 2593 65535 1 0 0 www.mozilla.org 2593 65535 2 0 0 groups.google.com 2593 65535 2 0 0 www.opensolaris.org 2593 65535 3 0 0 blogs.sun.com 2593 65535 3 0 0 lxr.mozilla.org 2593 65535 3 0 0 www.google.ie 2593 65535 1 435 435 lists.freebsd.org 2593 65535 1 468 468 mail.opensolaris.org 2593 65535 25 47 1185 2593 65535 1 4443 4443 bugzilla.mozilla.org URI Top 10 sites, PID UID COUNT AVG(msec) SUM(msec) SITE 2593 65535 1 0 0 http://www.abercornbasin.com/news_single.php?ID=1 2593 65535 1 0 0 http://www.google.ie/search?hl=en&q=mozilla+dtrace&btnG=Search&meta= 2593 65535 1 0 0 http://www.google.ie/search?hl=en&q=mozilla+dtrace+robert&btnG=Search&meta= 2593 65535 1 0 0 http://www.google.ie/search?q=jim+grizansio+blogs+sun&hl=en&filter=0 2593 65535 1 0 0 http://www.mozilla.org/projects/firefox/3.0a8pre/releasenotes/ 2593 65535 1 0 0 http://www.opensolaris.org/jive/forum.jspa?forumID=7 2593 65535 1 0 0 http://www.opensolaris.org/os/project/mozilla-dtrace/;jsessionid=D2C184F6D4B2316D68920A330AC0FB4D 2593 65535 0 429 429 file:///usr/share/doc/soldevex/html/developer_guide.html 2593 65535 0 435 435 http://lists.freebsd.org/pipermail/freebsd-current/2004-September/038227.html 2593 65535 1 468 468 http://mail.opensolaris.org/pipermail/dtrace-discuss/2005-December/000855.html 2593 65535 24 31 755 about:blank 2593 65535 1 4443 4443 https://bugzilla.mozilla.org/show_bug.cgi?id=370906 LOAD PROBE STATS: Total load-done's called 28 Total load-start's called 46 #!/usr/sbin/dtrace -CZs /* * browserspy_uri.d - trace and report browser URI requests. * * URI structure - spec: * ://:@://.;?# * * Probes: * mozilla:::load-start * mozilla:::load-done * * Args: * arg0 is of type void * - unique_id * arg1 is an enum nsTraceLoadType - TYPE_URI or TYPE_IMAGE * arg2 is of type struct nsTraceLoadInfo * - pointer to the URI info * */ #pragma D option quiet /* Any member of nsTraceLoadInfo can be returned as "" except spec and scheme */ struct nsTraceLoadInfo { char * contentType; /* mime type e.g. text/html - can be */ char * spec; /* Complete URI of above structure */ char * prePath; /* scheme://user:password@host:port */ char * scheme; /* protocol - http, file ... */ char * userPass; /* username:password */ char * username; char * password; char * hostPort; /* host:port or just host if port = -1 */ char * host; int port; char * path; /* path = ;?# */ char * filePath; /* . */ char * fileName; /* */ char * fileExtension; /* */ char * param; char * query; char * ref; }; enum nsTraceLoadType { TYPE_URI = 1, TYPE_IMAGE }; dtrace:::BEGIN { printf("Tracing Browser Network Activity... Hit Ctrl-C to end.\n"); top = 10; /* top sites to print */ } moz*:::load-start { type[pid, arg0] = arg1 == TYPE_URI ? "URI": "IMAGE"; } moz*:::load-start /type[pid, arg0] == "URI"/ { @["Total load-start's called"] = count(); this->info = (struct nsTraceLoadInfo *) copyin(arg2, sizeof (struct nsTraceLoadInfo)); @scheme[pid, uid, copyinstr((uintptr_t)this->info->scheme)] = count(); @site[pid, uid, copyinstr((uintptr_t)this->info->spec)] = count(); this->ct = copyinstr((uintptr_t)this->info->contentType) ; @ctype[pid, uid, this->ct == "" ? "":this->ct] = count(); this->fe = copyinstr((uintptr_t)this->info->fileExtension) ; @fext[pid, uid, this->fe == "" ? "":this->fe] = count(); this->un = copyinstr((uintptr_t)this->info->username) ; @user[pid, uid, this->un == "" ? "":this->un] = count(); this->hs = copyinstr((uintptr_t)this->info->host) ; @host[pid, uid, this->hs == "" ? "":this->hs] = count(); start[pid, arg0] = timestamp; } moz*:::load-done /start[pid, arg0] && type[pid, arg0] == "URI"/ { @["Total load-done's called"] = count(); this->elapsed = timestamp - start[pid, arg0]; this->info = (struct nsTraceLoadInfo *) copyin(arg2, sizeof (struct nsTraceLoadInfo)); @schemeavg[pid, uid, copyinstr((uintptr_t)this->info->scheme)] = avg(this->elapsed); @schemesum[pid, uid, copyinstr((uintptr_t)this->info->scheme)] = sum(this->elapsed); @siteavg[pid, uid, copyinstr((uintptr_t)this->info->spec)] = avg(this->elapsed); @sitesum[pid, uid, copyinstr((uintptr_t)this->info->spec)] = sum(this->elapsed); this->ct = copyinstr((uintptr_t)this->info->contentType) ; @ctypeavg[pid, uid, this->ct == "" ? "":this->ct] = avg(this->elapsed); @ctypesum[pid, uid, this->ct == "" ? "":this->ct] = sum(this->elapsed); this->fe = copyinstr((uintptr_t)this->info->fileExtension) ; @fextavg[pid, uid, this->fe == "" ? "":this->fe] = avg(this->elapsed); @fextsum[pid, uid, this->fe == "" ? "":this->fe] = sum(this->elapsed); this->un = copyinstr((uintptr_t)this->info->username) ; @useravg[pid, uid, this->un == "" ? "":this->un] = avg(this->elapsed); @usersum[pid, uid, this->un == "" ? "":this->un] = sum(this->elapsed); this->hs = copyinstr((uintptr_t)this->info->host) ; @hostavg[pid, uid, this->hs == "" ? "":this->hs] = avg(this->elapsed); @hostsum[pid, uid, this->hs == "" ? "":this->hs] = sum(this->elapsed); } moz*:::load-done /start[pid, arg0] && type[pid, arg0] == "URI"/ { type[pid, arg0] = NULL; start[pid, arg0] = 0; } dtrace:::END { /* URI Stats */ printf("\nURI structure:\n"); printf("://:@://.;?#\n"); printf("\nURI Browser requests by scheme,\n\n"); normalize(@schemeavg, 1000000); normalize(@schemesum, 1000000); setopt("aggsortpos", "2"); printf("%8s %8s %8s %11s %11s %-36s\n", "PID", "UID", "COUNT", "AVG(msec)", "SUM(msec)", "SCHEME"); printa("%8d %8d %@8d %@11d %@11d %-36s\n", @scheme, @schemeavg, @schemesum); printf("\nURI Browser requests by content type,\n\n"); normalize(@ctypeavg, 1000000); normalize(@ctypesum, 1000000); printf("%8s %8s %8s %11s %11s %-36s\n", "PID", "UID", "COUNT", "AVG(msec)", "SUM(msec)", "CONTENT_TYPE"); printa("%8d %8d %@8d %@11d %@11d %-36s\n", @ctype, @ctypeavg, @ctypesum); printf("\nURI Browser requests by username (if used),\n\n"); normalize(@useravg, 1000000); normalize(@usersum, 1000000); printf("%8s %8s %8s %11s %11s %-36s\n", "PID", "UID", "COUNT", "AVG(msec)", "SUM(msec)", "USERNAME"); printa("%8d %8d %@8d %@11d %@11d %-36s\n", @user, @useravg, @usersum); printf("\nURI Browser requests by file extension,\n\n"); normalize(@fextavg, 1000000); normalize(@fextsum, 1000000); printf("%8s %8s %8s %11s %11s %-36s\n", "PID", "UID", "COUNT", "AVG(msec)", "SUM(msec)", "FILE_EXT"); printa("%8d %8d %@8d %@11d %@11d %-36s\n", @fext, @fextavg, @fextsum); printf("\nURI Browser requests by host,\n\n"); normalize(@hostavg, 1000000); normalize(@hostsum, 1000000); printf("%8s %8s %8s %11s %11s %-36s\n", "PID", "UID", "COUNT", "AVG(msec)", "SUM(msec)", "HOST"); printa("%8d %8d %@8d %@11d %@11d %-36s\n", @host, @hostavg, @hostsum); trunc(@site, top); trunc(@siteavg, top); trunc(@sitesum, top); printf("\nURI Top %d sites,\n\n", top); normalize(@siteavg, 1000000); normalize(@sitesum, 1000000); printf("%8s %8s %8s %11s %11s %-36s\n", "PID", "UID", "COUNT", "AVG(msec)", "SUM(msec)", "SITE"); printa("%8d %8d %@8d %@11d %@11d %-36s\n", @site, @siteavg, @sitesum); printf("\nLOAD PROBE STATS:\n\n"); printa("%-25s %@10d\n", @); }