title: eBPF bcctools get contents from tracepipe
body: <p>This is small program that traces communication in tracepipe. My question is how do I access the contents of tracepipe using bcctools.
  I tried manually reading the file using <code>fopen</code> but that does not work, is there any function I am not aware of?</p>
  <pre><code>Modified  #define KBUILD_MODNAME &quot;filter&quot;
  #include &lt;linux/bpf.h&gt;
  #include &lt;linux/if_ether.h&gt;
  #include &lt;linux/ip.h&gt;
  #include &lt;linux/in.h&gt;
  #include &lt;linux/udp.h&gt;
  
  #include &lt;linux/if_packet.h&gt;
  #include &lt;linux/if_vlan.h&gt;
  
  
  int udpfilter(struct xdp_md *ctx) {
    bpf_trace_printk(&quot;got a packet\n&quot;);
    void *data = (void *)(long)ctx-&gt;data;
    void *data_end = (void *)(long)ctx-&gt;data_end;
    struct ethhdr *eth = data;
    if ((void*)eth + sizeof(*eth) &lt;= data_end) {
      struct iphdr *ip = data + sizeof(*eth);
      if ((void*)ip + sizeof(*ip) &lt;= data_end) {
        if (ip-&gt;protocol == IPPROTO_UDP) {
          struct udphdr *udp = (void*)ip + sizeof(*ip);
          if ((void*)udp + sizeof(*udp) &lt;= data_end) {
            if (udp-&gt;dest == ntohs(7999)) {
              bpf_trace_printk(&quot;udp port 7999\n&quot;);
              udp-&gt;dest = ntohs(7998);
            }
          }
        }
      }
    }
    return XDP_PASS;
  }
  </code></pre>