@mark1russell7/prober 0.1.0 → 0.3.0

package/README.md

@@ -17,11 +17,21 @@ The kernel program records these events:
 - TIME_WAIT sockets and request sockets.
 - Each keepalive probe or zero-window probe that `tcp_write_wakeup` sends.
 - Each segment that an established socket receives (`tcp_probe`).
+- Each write of the owner of a socket (`tx`, at the entry of `tcp_sendmsg`), with the first sequence number of the bytes and their length. The time of a proxy is from an arrival on one of its sockets to a write on the other.
 - The state of the retransmit timer at each retransmission.
 - Each time that the timer wheel fires the keepalive timer or the retransmit timer of a socket (`timer`).
 
 The state of the retransmit timer tells the tail loss probe from the retransmissions of the RTO timer. Only the RTO timer counts toward `tcp_retries2`.
 
+Each record with TCP state (`tcp`) also has the SACK scoreboard and the reordering state of the socket, by the names of `tcp_info`:
+
+- **`sacked`** and **`lost`** are the segments that the peer SACKed and that the kernel marked lost.
+- **`reordering`** is the reordering degree of the kernel, in segments. It starts at `tcp_reordering`, and it increases when the kernel detects reordering. **`reord_seen`** counts those detections.
+- **`dsack_dups`** counts the DSACK blocks that arrived: segments that the peer got two times.
+- **`rcv_ooopack`** counts the segments that arrived out of order.
+
+A record of version 0.1 does not have these fields, and it has no `tx` records.
+
 A `timer` record has three more fields:
 
 - **`behind`** is the number of jiffies between the slot of the timer on the wheel and the time that the CPU fired it. The wheel fires a slot in its tick. Thus a timer behind its slot shows a delay of its CPU, for example a vCPU that the host stopped.
@@ -64,7 +74,7 @@ The Go and C collectors are in the repository for the comparison. They are not i
 
 Each collector has a `--decode FILE` mode, which reads raw records from a file and not from the kernel. This mode holds the three to one contract:
 
-- `fixtures/records.bin` has 46 raw records, and one record that is cut short. The records have each kind, each optional field, the extremes of each integer, the escapes of JSON and each way to break UTF-8. `src/fixture.ts` makes the file, and its test keeps the committed bytes the same as the output.
+- `fixtures/records.bin` has 48 raw records, and one record that is cut short. The records have each kind, each optional field, the extremes of each integer, the escapes of JSON and each way to break UTF-8. `src/fixture.ts` makes the file, and its test keeps the committed bytes the same as the output.
 - The Rust test compares the writer of the crate with the output of serde, record by record. It also compares the names with the lossy decoder of the standard library.
 - The comparison image (`image/Dockerfile`) decodes the fixture with the three collectors. The build stops unless each line is the same, byte for byte.
 

package/bpf/prober.bpf.c

@@ -5,14 +5,15 @@
  *
  * Its core was built and verified first: the state changes, the owner at
  * connect and accept, retransmissions, resets, error reports, destruction, TIME_WAIT and request
- * socks, with the socket cookie, the namespace and the cgroup. The harness adds four things:
+ * socks, with the socket cookie, the namespace and the cgroup. The harness adds five things:
  * - each probe tcp_write_wakeup sends, as keepalive or zero-window;
  * - every segment received on an established socket, so a frozen peer's ACKs show;
  * - the connection's retransmit-timer state on each retransmission, so the tail loss probe (its
  *   pending event is the loss probe) parts from the RTO timer's retransmissions, which alone
- *   count toward tcp_retries2;
+ *   count toward tcp_retries2; with it the SACK scoreboard and the reordering state;
  * - each run of a socket's keepalive or retransmit timer, with how far behind its wheel slot it
- *   ran, so a run that a stalled vCPU delayed tells itself apart from the kernel's own timing. */
+ *   ran, so a run that a stalled vCPU delayed tells itself apart from the kernel's own timing;
+ * - each write of the owner, so a proxy's own time shows between its two sockets. */
 #include "vmlinux.h"
 #include <bpf/bpf_helpers.h>
 #include <bpf/bpf_tracing.h>
@@ -95,6 +96,12 @@ static __always_inline void fill_tcp(struct ev *e, const struct sock *sk)
 	e->tcp.snd_una = BPF_CORE_READ(tp, snd_una);
 	e->tcp.snd_nxt = BPF_CORE_READ(tp, snd_nxt);
 	e->tcp.rcv_nxt = BPF_CORE_READ(tp, rcv_nxt);
+	e->tcp.sacked_out = BPF_CORE_READ(tp, sacked_out);
+	e->tcp.lost_out = BPF_CORE_READ(tp, lost_out);
+	e->tcp.reordering = BPF_CORE_READ(tp, reordering);
+	e->tcp.reord_seen = BPF_CORE_READ(tp, reord_seen);
+	e->tcp.dsack_dups = BPF_CORE_READ(tp, dsack_dups);
+	e->tcp.rcv_ooopack = BPF_CORE_READ(tp, rcv_ooopack);
 }
 
 SEC("tp_btf/inet_sock_set_state")
@@ -287,6 +294,21 @@ int BPF_PROG(on_rx, struct sock *sk, struct sk_buff *skb)
 	return 0;
 }
 
+/* every write the owner makes: the bytes enter the socket here, and with TCP_NODELAY leave it in
+ * the same call. A proxy's time is from its arrival on one socket to this on the other. */
+SEC("fentry/tcp_sendmsg")
+int BPF_PROG(on_tx, struct sock *sk, struct msghdr *msg, size_t size)
+{
+	struct ev *e = sk_record(sk, EV_TX, 0);
+	if (!e) return 0;
+	fill_tcp(e, sk);
+	e->has_seg = 1;
+	e->seg.seq = BPF_CORE_READ((struct tcp_sock *)sk, write_seq);
+	e->seg.len = (__u32)size;
+	bpf_ringbuf_submit(e, wake());
+	return 0;
+}
+
 SEC("tp_btf/tcp_send_reset")
 int BPF_PROG(on_rst_tx, const struct sock *sk, const struct sk_buff *skb) { return sk_event(sk, EV_RST_TX, skb == 0); }
 

package/bpf/prober.h

@@ -17,6 +17,7 @@ enum {
 	EV_PROBE,     /* a probe sent by tcp_write_wakeup: keepalive or zero window */
 	EV_RX,        /* a segment received on an established socket (tcp_probe) */
 	EV_TIMER,     /* a socket's own timer run from the wheel: its keepalive, or its retransmit timer */
+	EV_TX,        /* bytes the owner gave the socket to send (tcp_sendmsg): a proxy's departure */
 };
 
 /* what EV_PROBE's extra says the probe was */
@@ -35,9 +36,17 @@ struct tcp_now {
 	__u32 rto;         /* icsk_rto, in jiffies */
 	__u32 srtt_us;     /* the smoothed RTT, in microseconds */
 	__u32 snd_una, snd_nxt, rcv_nxt;
+	/* the scoreboard and the reordering state: what SACK, DSACK and out-of-order arrivals did */
+	__u32 sacked_out;  /* the segments the peer SACKed */
+	__u32 lost_out;    /* the segments marked lost */
+	__u32 reordering;  /* the reordering degree the kernel holds, in segments: tcp_reordering at first */
+	__u32 reord_seen;  /* the reorderings the kernel detected */
+	__u32 dsack_dups;  /* the DSACK blocks received: segments the peer got twice */
+	__u32 rcv_ooopack; /* the segments that arrived out of order */
 };
 
-/* the segment a record is about: retransmitted, or received */
+/* the segment a record is about: retransmitted, or received; for EV_TX, the write: its first
+ * sequence number (write_seq) and its length */
 struct seg {
 	__u32 seq, ack, len, flags;
 };

package/build/index.d.ts

@@ -1,7 +1,7 @@
 import { Quantity } from "@mark1russell7/quantity";
 //#region src/index.d.ts
 /** These are the kinds of record, in the sequence of the enum in `bpf/prober.h` and of `KINDS` in the Rust decoder. */
-export declare const RECORD_KINDS: readonly ["state", "accept", "retrans", "rst_tx", "rst_rx", "error", "destroy", "tw_enter", "tw_kill", "req_new", "rst_v4", "probe", "rx", "timer"];
+export declare const RECORD_KINDS: readonly ["state", "accept", "retrans", "rst_tx", "rst_rx", "error", "destroy", "tw_enter", "tw_kill", "req_new", "rst_v4", "probe", "rx", "timer", "tx"];
 /** A record kind is one kind of record that the kernel side writes. */
 export type RecordKind = (typeof RECORD_KINDS)[number];
 /** These are the lines of the collector itself: its start, its clock track, its failure, and a record that it cannot read. */
@@ -40,10 +40,31 @@ export interface KernelRecord {
     readonly probes_out: number;
     readonly rto: Quantity;
     readonly srtt: Quantity;
+    readonly snd_una?: number;
+    readonly snd_nxt?: number;
+    readonly rcv_nxt?: number;
+    /**
+     * These counts are the SACK scoreboard and the reordering state, as `tcp_info` names them. A
+     * record of version 0.1 does not have them. `sacked` and `lost` are the segments that the peer
+     * SACKed and that the kernel marked lost. `reordering` is the reordering degree of the kernel,
+     * in segments, and `reord_seen` counts the reorderings that it detected. `dsack_dups` counts
+     * the DSACK blocks that arrived, and `rcv_ooopack` the segments that arrived out of order.
+     */
+    readonly sacked?: number;
+    readonly lost?: number;
+    readonly reordering?: number;
+    readonly reord_seen?: number;
+    readonly dsack_dups?: number;
+    readonly rcv_ooopack?: number;
   };
+  /**
+   * This record is the segment of a record. For `rx`, it has the acknowledgment and the flags. For
+   * `tx`, it is the write: its first sequence number and its length.
+   */
   readonly seg?: {
     readonly seq: number;
     readonly ack?: number;
+    readonly flags?: number;
     readonly len: Quantity;
   };
   readonly [field: string]: unknown;

package/build/index.js

@@ -14,7 +14,8 @@ const RECORD_KINDS = [
 	"rst_v4",
 	"probe",
 	"rx",
-	"timer"
+	"timer",
+	"tx"
 ];
 //#endregion
 export { RECORD_KINDS };

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["// @mark1russell7/prober: the instrument that records what each layer did to a connection. Its\n// first source is the kernel: bpf/prober.bpf.c, a libbpf CO-RE program, and the collector in\n// native/ that prints each record as a JSON line. This module is the record contract for the\n// readers of those lines.\n\nimport type { Quantity } from \"@mark1russell7/quantity\";\n\n/** These are the kinds of record, in the sequence of the enum in `bpf/prober.h` and of `KINDS` in the Rust decoder. */\nexport const RECORD_KINDS = [\n  \"state\",\n  \"accept\",\n  \"retrans\",\n  \"rst_tx\",\n  \"rst_rx\",\n  \"error\",\n  \"destroy\",\n  \"tw_enter\",\n  \"tw_kill\",\n  \"req_new\",\n  \"rst_v4\",\n  \"probe\",\n  \"rx\",\n  \"timer\",\n] as const;\n\n/** A record kind is one kind of record that the kernel side writes. */\nexport type RecordKind = (typeof RECORD_KINDS)[number];\n\n/** These are the lines of the collector itself: its start, its clock track, its failure, and a record that it cannot read. */\nexport type CollectorLine = \"begin\" | \"clock\" | \"fail\" | \"undecodable\";\n\n/**\n * A kernel record is one record of the prober: what the kernel did to a socket. The eBPF side\n * stamps it on CLOCK_MONOTONIC, the clock that all containers on the VM share (`native/src/record.rs`).\n */\nexport interface KernelRecord {\n  readonly ev: RecordKind | CollectorLine | string;\n  readonly mono: number;\n  readonly cookie?: number;\n  readonly netns?: number;\n  readonly src?: string;\n  readonly dst?: string;\n  readonly state?: number;\n  /** This number is the `sk_err` of the socket at the time of the record: the errno of an error report. */\n  readonly err?: number;\n  /** This value is the cause of a retransmission: the tail loss probe, the RTO timer, or a fast retransmission from ACK processing. */\n  readonly why?: \"tlp\" | \"rto\" | \"fast\";\n  /** This value is the kind of a probe that `tcp_write_wakeup` sent, or of a socket timer that fired. */\n  readonly what?: \"keepalive\" | \"window\" | \"retransmit\" | \"other\";\n  /**\n   * For a socket timer that fired, `behind` is the delay of the CPU after the slot of the timer\n   * wheel. Only a stalled CPU causes that delay. `late` is the time after the expiry of the timer,\n   * with the rounding of the wheel.\n   */\n  readonly behind?: Quantity;\n  readonly late?: Quantity;\n  /** This flag tells that a socket timer fired while the owner of the socket held it. Keepalive then tries again HZ/20 later. */\n  readonly owned?: boolean;\n  readonly tcp?: {\n    readonly retransmits: number;\n    readonly pending: number;\n    readonly backoff: number;\n    readonly probes_out: number;\n    readonly rto: Quantity;\n    readonly srtt: Quantity;\n  };\n  readonly seg?: { readonly seq: number; readonly ack?: number; readonly len: Quantity };\n  readonly [field: string]: unknown;\n}\n"],"mappings":";;AAQA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["// @mark1russell7/prober: the instrument that records what each layer did to a connection. Its\n// first source is the kernel: bpf/prober.bpf.c, a libbpf CO-RE program, and the collector in\n// native/ that prints each record as a JSON line. This module is the record contract for the\n// readers of those lines.\n\nimport type { Quantity } from \"@mark1russell7/quantity\";\n\n/** These are the kinds of record, in the sequence of the enum in `bpf/prober.h` and of `KINDS` in the Rust decoder. */\nexport const RECORD_KINDS = [\n  \"state\",\n  \"accept\",\n  \"retrans\",\n  \"rst_tx\",\n  \"rst_rx\",\n  \"error\",\n  \"destroy\",\n  \"tw_enter\",\n  \"tw_kill\",\n  \"req_new\",\n  \"rst_v4\",\n  \"probe\",\n  \"rx\",\n  \"timer\",\n  \"tx\",\n] as const;\n\n/** A record kind is one kind of record that the kernel side writes. */\nexport type RecordKind = (typeof RECORD_KINDS)[number];\n\n/** These are the lines of the collector itself: its start, its clock track, its failure, and a record that it cannot read. */\nexport type CollectorLine = \"begin\" | \"clock\" | \"fail\" | \"undecodable\";\n\n/**\n * A kernel record is one record of the prober: what the kernel did to a socket. The eBPF side\n * stamps it on CLOCK_MONOTONIC, the clock that all containers on the VM share (`native/src/record.rs`).\n */\nexport interface KernelRecord {\n  readonly ev: RecordKind | CollectorLine | string;\n  readonly mono: number;\n  readonly cookie?: number;\n  readonly netns?: number;\n  readonly src?: string;\n  readonly dst?: string;\n  readonly state?: number;\n  /** This number is the `sk_err` of the socket at the time of the record: the errno of an error report. */\n  readonly err?: number;\n  /** This value is the cause of a retransmission: the tail loss probe, the RTO timer, or a fast retransmission from ACK processing. */\n  readonly why?: \"tlp\" | \"rto\" | \"fast\";\n  /** This value is the kind of a probe that `tcp_write_wakeup` sent, or of a socket timer that fired. */\n  readonly what?: \"keepalive\" | \"window\" | \"retransmit\" | \"other\";\n  /**\n   * For a socket timer that fired, `behind` is the delay of the CPU after the slot of the timer\n   * wheel. Only a stalled CPU causes that delay. `late` is the time after the expiry of the timer,\n   * with the rounding of the wheel.\n   */\n  readonly behind?: Quantity;\n  readonly late?: Quantity;\n  /** This flag tells that a socket timer fired while the owner of the socket held it. Keepalive then tries again HZ/20 later. */\n  readonly owned?: boolean;\n  readonly tcp?: {\n    readonly retransmits: number;\n    readonly pending: number;\n    readonly backoff: number;\n    readonly probes_out: number;\n    readonly rto: Quantity;\n    readonly srtt: Quantity;\n    readonly snd_una?: number;\n    readonly snd_nxt?: number;\n    readonly rcv_nxt?: number;\n    /**\n     * These counts are the SACK scoreboard and the reordering state, as `tcp_info` names them. A\n     * record of version 0.1 does not have them. `sacked` and `lost` are the segments that the peer\n     * SACKed and that the kernel marked lost. `reordering` is the reordering degree of the kernel,\n     * in segments, and `reord_seen` counts the reorderings that it detected. `dsack_dups` counts\n     * the DSACK blocks that arrived, and `rcv_ooopack` the segments that arrived out of order.\n     */\n    readonly sacked?: number;\n    readonly lost?: number;\n    readonly reordering?: number;\n    readonly reord_seen?: number;\n    readonly dsack_dups?: number;\n    readonly rcv_ooopack?: number;\n  };\n  /**\n   * This record is the segment of a record. For `rx`, it has the acknowledgment and the flags. For\n   * `tx`, it is the write: its first sequence number and its length.\n   */\n  readonly seg?: {\n    readonly seq: number;\n    readonly ack?: number;\n    readonly flags?: number;\n    readonly len: Quantity;\n  };\n  readonly [field: string]: unknown;\n}\n"],"mappings":";;AAQA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/native/src/record.rs

@@ -11,14 +11,14 @@ use std::borrow::Cow;
 use std::net::Ipv4Addr;
 
 /// `struct ev`'s size in bytes. In order: seven u64, five u32, seven i32, two u16, two u32,
-/// `struct tcp_now` (nine u32), `struct seg` (four u32), two u32 for a timer and a 16-byte comm.
-/// Every field sits on its own alignment, so the C compiler adds no padding.
-pub const SIZE: usize = 192;
+/// `struct tcp_now` (fifteen u32), `struct seg` (four u32), two u32 for a timer and a 16-byte
+/// comm. Every field sits on its own alignment, so the C compiler adds no padding.
+pub const SIZE: usize = 216;
 
 /// The event kinds, in `prober.h`'s order, from 1.
-const KINDS: [&str; 14] = [
+const KINDS: [&str; 15] = [
     "state", "accept", "retrans", "rst_tx", "rst_rx", "error", "destroy", "tw_enter", "tw_kill",
-    "req_new", "rst_v4", "probe", "rx", "timer",
+    "req_new", "rst_v4", "probe", "rx", "timer", "tx",
 ];
 
 /// ICSK_TIME_LOSS_PROBE in include/net/inet_connection_sock.h: the tail loss probe is armed
@@ -39,6 +39,13 @@ pub struct TcpNow {
     pub snd_una: u32,
     pub snd_nxt: u32,
     pub rcv_nxt: u32,
+    /// the SACK scoreboard and the reordering state, as `tcp_info` names them
+    pub sacked_out: u32,
+    pub lost_out: u32,
+    pub reordering: u32,
+    pub reord_seen: u32,
+    pub dsack_dups: u32,
+    pub rcv_ooopack: u32,
 }
 
 #[derive(Debug, Clone, PartialEq)]
@@ -138,6 +145,12 @@ impl Ev {
             snd_una: f.u32(),
             snd_nxt: f.u32(),
             rcv_nxt: f.u32(),
+            sacked_out: f.u32(),
+            lost_out: f.u32(),
+            reordering: f.u32(),
+            reord_seen: f.u32(),
+            dsack_dups: f.u32(),
+            rcv_ooopack: f.u32(),
         };
         let seg = Seg { seq: f.u32(), ack: f.u32(), len: f.u32(), flags: f.u32() };
         let (behind, late) = (f.u32(), f.u32());
@@ -206,11 +219,17 @@ impl Ev {
 #[derive(Serialize)]
 pub struct TcpOut {
     pub backoff: u32,
+    pub dsack_dups: u32,
+    pub lost: u32,
     pub pending: u32,
     pub probes_out: u32,
     pub rcv_nxt: u32,
+    pub rcv_ooopack: u32,
+    pub reord_seen: u32,
+    pub reordering: u32,
     pub retransmits: u32,
     pub rto: Quantity,
+    pub sacked: u32,
     pub snd_nxt: u32,
     pub snd_una: u32,
     pub srtt: Quantity,
@@ -334,6 +353,12 @@ impl<'a> From<&'a Ev> for Record<'a> {
                 snd_una: t.snd_una,
                 snd_nxt: t.snd_nxt,
                 rcv_nxt: t.rcv_nxt,
+                sacked: t.sacked_out,
+                lost: t.lost_out,
+                reordering: t.reordering,
+                reord_seen: t.reord_seen,
+                dsack_dups: t.dsack_dups,
+                rcv_ooopack: t.rcv_ooopack,
             }),
             seg: e.seg.as_ref().map(|s| SegOut {
                 seq: s.seq,
@@ -546,16 +571,28 @@ impl Ev {
         if let Some(t) = &self.tcp {
             out.extend_from_slice(b",\"tcp\":{\"backoff\":");
             push_u64(out, t.backoff.into());
+            out.extend_from_slice(b",\"dsack_dups\":");
+            push_u64(out, t.dsack_dups.into());
+            out.extend_from_slice(b",\"lost\":");
+            push_u64(out, t.lost_out.into());
             out.extend_from_slice(b",\"pending\":");
             push_u64(out, t.pending.into());
             out.extend_from_slice(b",\"probes_out\":");
             push_u64(out, t.probes_out.into());
             out.extend_from_slice(b",\"rcv_nxt\":");
             push_u64(out, t.rcv_nxt.into());
+            out.extend_from_slice(b",\"rcv_ooopack\":");
+            push_u64(out, t.rcv_ooopack.into());
+            out.extend_from_slice(b",\"reord_seen\":");
+            push_u64(out, t.reord_seen.into());
+            out.extend_from_slice(b",\"reordering\":");
+            push_u64(out, t.reordering.into());
             out.extend_from_slice(b",\"retransmits\":");
             push_u64(out, t.retransmits.into());
             out.extend_from_slice(b",\"rto\":");
             push_quantity(out, t.rto, "jiffy");
+            out.extend_from_slice(b",\"sacked\":");
+            push_u64(out, t.sacked_out.into());
             out.extend_from_slice(b",\"snd_nxt\":");
             push_u64(out, t.snd_nxt.into());
             out.extend_from_slice(b",\"snd_una\":");
@@ -610,7 +647,7 @@ mod tests {
         b.extend_from_slice(&6379_u16.to_ne_bytes());
         b.extend_from_slice(&1_u32.to_ne_bytes());
         b.extend_from_slice(&1_u32.to_ne_bytes());
-        for v in [retransmits, pending, 1, 0, 102, 80, 10, 16, 20] {
+        for v in [retransmits, pending, 1, 0, 102, 80, 10, 16, 20, 2, 1, 3, 0, 1, 4] {
             b.extend_from_slice(&v.to_ne_bytes());
         }
         for v in [10_u32, 0, 6, 0] {
@@ -637,6 +674,18 @@ mod tests {
         assert_eq!(json["why"], "rto");
         assert_eq!(json["src"], "172.21.0.3:41978");
         assert_eq!(json["tcp"]["rto"], serde_json::json!({ "value": 102.0, "unit": "jiffy" }));
+        // the SACK scoreboard and the reordering state, by the names of tcp_info
+        assert_eq!((&json["tcp"]["sacked"], &json["tcp"]["lost"]), (&serde_json::json!(2), &serde_json::json!(1)));
+        assert_eq!((&json["tcp"]["reordering"], &json["tcp"]["rcv_ooopack"]), (&serde_json::json!(3), &serde_json::json!(4)));
+    }
+
+    #[test]
+    fn says_what_a_write_gave_the_socket() {
+        let ev = Ev::decode(&raw(15, 0, 0)).unwrap();
+        assert_eq!(ev.kind_name(), "tx");
+        let json = serde_json::to_value(Record::from(&ev)).unwrap();
+        // a write has its first sequence number and its length, but no ack and no flags
+        assert_eq!(json["seg"], serde_json::json!({ "len": { "value": 6.0, "unit": "B" }, "seq": 10 }));
     }
 
     #[test]
@@ -670,7 +719,7 @@ mod tests {
 
     #[test]
     fn refuses_a_record_of_the_wrong_size() {
-        assert!(Ev::decode(&[0u8; 12]).unwrap_err().contains("192 bytes"));
+        assert!(Ev::decode(&[0u8; 12]).unwrap_err().contains("216 bytes"));
     }
 
     /// every whole record of the identity fixture, which the Go and C collectors are held to
@@ -691,6 +740,6 @@ mod tests {
             );
             checked += 1;
         }
-        assert_eq!(checked, 46);
+        assert_eq!(checked, 48);
     }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@mark1russell7/prober",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "An eBPF prober for TCP: a CO-RE kernel program and its Rust collector, which record what the kernel did to each socket, with the record contract in TypeScript.",
   "keywords": [
     "ebpf",
@@ -51,7 +51,7 @@
     "node": ">=22.19"
   },
   "dependencies": {
-    "@mark1russell7/quantity": "^0.1.0"
+    "@mark1russell7/quantity": "^0.2.0"
   },
   "peerDependencies": {
     "zod": "^4.1.0"