#!/usr/sbin/dtrace -qs fbt:ipf:ipf_hook_out:entry { self->watch=1; self->token=arg0; self->data=arg1; } fbt:ipf:ipf_hook_out:return / self->watch == 1 && arg1 != 0 / { printf("Problem with data in filter rule from %s %x\n",execname,self->data); printf("user stack\n"); ustack(); self->watch=0; }