figure 2. call graph for ip_output().

carp_send_ad_locked

div_output

dummynet_send

icmp_send

igmp_sendpkt

in_gif_output

ip_output

tcp_output

tcp_respond

tcp_twrespond

udp_output

carp_send_ad

carp_send_ad_all

div_send

dummynet_io

icmp_reflect

igmp_fasttimo

igmp_joingroup

igmp_leavegroup

tcp_ctloutput

tcp_newreno_partial_ack

tcp_sack_partialack

tcp_timer_delack

tcp_timer_persist

tcp_timer_rexmt

tcp_dropwithreset

tcp_timer_keep

tcp_twcheck

tcp_twstart

udp_send

carp_master_down_locked

carp_setrun

ip_forward

ipfw_tick

rip_output

send_packet

send_reject

syncache_respond

tcp_do_segment

carp_ictl

ip_dooptions

rip_send

phyint_send

pim_register_send_rp

ipfw_chk

_syncache_add

syncache_timer

carp_clone_create

ip_input

ipfw_init

 

the process as well as on locks. Some of the providers available on Mac OS X are shown in Table 3.

Probes are not only associated with providers but also with modules, which are the modules you want to

instrument, as well as with functions, which are also subject to observation. The name of a trace point specifies a single probe. All of these categories are put together in a DTrace script or command line to form a sort of address

that specifies what the engineer is trying to observe. The canonical form is provider:module:function:name, with an empty section indicating a wildcard. Although the two manuals from Sun are excellent references on DTrace, ^{6, 10}