bcc-tcpretrans(8)

1tcpretrans(8)               System Manager's Manual              tcpretrans(8)
2
3
4

NAME

6       tcpretrans  -  Trace  or  count  TCP  retransmits  and TLPs. Uses Linux
7       eBPF/bcc.
8

SYNOPSIS

10       tcpretrans [-h] [-l]
11

DESCRIPTION

13       This traces TCP retransmits,  showing  address,  port,  and  TCP  state
14       information,  and  sometimes  the  PID  (although  usually  not,  since
15       retransmits are usually sent by the kernel on timeouts). To keep  over‐
16       head  very low, only the TCP retransmit functions are traced. This does
17       not trace every packet (like tcpdump(8) or a packet  sniffer).  Option‐
18       ally,  it  can count retransmits over a user signalled interval to spot
19       potentially dropping network paths the flows are traversing.
20
21       This uses  dynamic  tracing  of  the  kernel  tcp_retransmit_skb()  and
22       tcp_send_loss_probe()  functions,  and will need to be updated to match
23       kernel changes to these functions.
24
25       Since this uses BPF, only the root user can use this tool.
26

REQUIREMENTS

28       CONFIG_BPF and bcc.
29

OPTIONS

31       -h     Print usage message.
32
33       -l     Include tail loss probe attempts (in some cases the  kernel  may
34              not complete the TLP send).
35
36       -c     Count occurring retransmits per flow.
37

EXAMPLES

39       Trace TCP retransmits:
40              # tcpretrans
41
42       Trace TCP retransmits and TLP attempts:
43              # tcpretrans -l
44

FIELDS

46       TIME   Time of the retransmit.
47
48       PID    Process  ID  that  was on-CPU. This is less useful than it might
49              sound, as it may usually be 0, for the kernel,  for  timer-based
50              retransmits.
51
52       IP     IP address family (4 or 6).
53
54       LADDR  Local IP address.
55
56       LPORT  Local port.
57
58       T>     Type of event: R> == retransmit, L> == tail loss probe.
59
60       RADDR  Remote IP address.
61
62       RPORT  Remote port.
63
64       STATE  TCP session state.
65
66       RETRANSMITS
67              Accumulated occurred retransmits since start.
68

OVERHEAD

70       Should  be  negligible:  TCP retransmit events should be low (<1000/s),
71       and the low overhead this tool adds to each event should make the  cost
72       negligible.
73

SOURCE

75       This is from bcc.
76
77              https://github.com/iovisor/bcc
78
79       Also  look  in  the bcc distribution for a companion _examples.txt file
80       containing example usage, output, and commentary for this tool.
81

OS

83       Linux
84

STABILITY

86       Unstable - in development.
87

AUTHOR

89       Brendan Gregg
90