bcc-tcpconnlat(8)

1tcpconnlat(8)               System Manager's Manual              tcpconnlat(8)
2
3
4

NAME

6       tcpconnlat - Trace TCP active connection latency. Uses Linux eBPF/bcc.
7

SYNOPSIS

9       tcpconnlat [-h] [-t] [-p PID] [-v] [min_ms]
10

DESCRIPTION

12       This  tool traces active TCP connections (eg, via a connect() syscall),
13       and shows the latency (time) for the connection  as  measured  locally:
14       the  time  from SYN sent to the response packet.  This is a useful per‐
15       formance metric that typically spans kernel TCP/IP processing  and  the
16       network round trip time (not application runtime).
17
18       All  connection  attempts are traced, even if they ultimately fail (RST
19       packet in response).
20
21       This tool works by use of kernel dynamic tracing of  TCP/IP  functions,
22       and  will  need  updating to match any changes to these functions. This
23       tool should be updated in the future to use  static  tracepoints,  once
24       they are available.
25
26       Since this uses BPF, only the root user can use this tool.
27

REQUIREMENTS

29       CONFIG_BPF and bcc.
30

OPTIONS

32       -h     Print usage message.
33
34       -t     Include a timestamp column.
35
36       -p PID Trace this process ID only (filtered in-kernel).
37
38       -v     Print the resulting BPF program, for debugging purposes.
39
40       min_ms Minimum duration to trace, in milliseconds.
41

EXAMPLES

43       Trace   all   active  TCP  connections,  and  show  connection  latency
44       (SYN->response round trip):
45              # tcpconnlat
46
47       Include timestamps:
48              # tcpconnlat -t
49
50       Trace PID 181 only:
51              # tcpconnlat -p 181
52
53       Trace connects with latency longer than 10 ms:
54              # tcpconnlat 10
55
56       Print the BPF program:
57              # tcpconnlat -v
58

FIELDS

60       TIME(s)
61              Time of the response packet, in seconds.
62
63       PID    Process ID that initiated the connection.
64
65       COMM   Process name that initiated the connection.
66
67       IP     IP address family (4 or 6).
68
69       SADDR  Source IP address.
70
71       DADDR  Destination IP address.
72
73       DPORT  Destination port
74
75       LAT(ms)
76              The time from when a TCP connect was issued (measured in-kernel)
77              to  when a response packet was received for this connection (can
78              be SYN,ACK, or RST, etc).  This  time  spans  kernel  to  kernel
79              latency,  involving  kernel  TCP/IP  processing  and the network
80              round trip in between. This  typically  does  not  include  time
81              spent by the application processing the new connection.
82

OVERHEAD

84       This  traces  the  kernel tcp_v[46]_connect functions and prints output
85       for each event. As the rate of this is generally expected to be low  (<
86       1000/s), the overhead is also expected to be negligible. If you have an
87       application that is calling a high rate of connects()s, such as a proxy
88       server, then test and understand this overhead before use.
89

SOURCE

91       This is from bcc.
92
93              https://github.com/iovisor/bcc
94
95       Also  look  in  the bcc distribution for a companion _examples.txt file
96       containing example usage, output, and commentary for this tool.
97

OS

99       Linux
100

STABILITY

102       Unstable - in development.
103

AUTHOR

105       Brendan Gregg
106