SOCKETLAT_SENDSLOW 源端口大小端转换问题

static __always_inline void set_tuple_sock(struct sock *sk, struct tuple *tpl) {
short unsigned int skc_family;
skc_family = BPF_CORE_READ(sk, __sk_common.skc_family);
if (skc_family == PF_INET6) {
// TODO: add v6 sock support
tpl->l3_proto = ETH_P_IPV6;
} else {
bpf_probe_read(&tpl->saddr, sizeof(tpl->saddr.v4addr),
&sk->__sk_common.skc_rcv_saddr);
bpf_probe_read(&tpl->daddr, sizeof(tpl->daddr.v4addr),
&sk->__sk_common.skc_daddr);
tpl->l3_proto = ETH_P_IP;
}

tpl->sport = BPF_CORE_READ(sk, __sk_common.skc_num);
tpl->dport = BPF_CORE_READ(sk, __sk_common.skc_dport);
tpl->l4_proto = get_sock_protocol(sk);
;
}
源目的端口的字段类型是
struct {
__be16 skc_dport;
__u16 skc_num;
};
用户态程序对源目的端口都进行了 bits.ReverseBytes16 转换
tuple := fmt.Sprintf("protocol=%s saddr=%s sport=%d daddr=%s dport=%d ", bpfutil.GetProtoStr(event.Tuple.L4Proto), bpfutil.GetAddrStr(event.Tuple.L3Proto, *(*[16]byte)(unsafe.Pointer(&event.Tuple.Saddr))), bits.ReverseBytes16(event.Tuple.Sport), bpfutil.GetAddrStr(event.Tuple.L3Proto, *(*[16]byte)(unsafe.Pointer(&event.Tuple.Daddr))), bits.ReverseBytes16(event.Tuple.Dport))

从而导致event日志事件，获取的目的端口是正确的，源端口是错误的

Start by locating set_tuple_sock and the Go user-space tuple formatting shown in the issue. Trace how skc_num and skc_dport are read and converted, then verify that event logs report both source and destination ports correctly.

Written by the indexing model from the issue text.