bcc-tcpaccept(8)

1tcpaccept(8)                System Manager's Manual               tcpaccept(8)
2
3
4

NAME

6       tcpaccept  -  Trace  TCP  passive  connections  (accept()).  Uses Linux
7       eBPF/bcc.
8

SYNOPSIS

10       tcpaccept [-h] [-T] [-t] [-p  PID]  [-P  PORTS]  [--cgroupmap  MAPPATH]
11       [--mntnsmap MAPPATH]
12

DESCRIPTION

14       This  tool traces passive TCP connections (eg, via an accept() syscall;
15       connect() are active connections). This can be useful for general trou‐
16       bleshooting to see what new connections the local server is accepting.
17
18       This  uses dynamic tracing of the kernel inet_csk_accept() socket func‐
19       tion (from tcp_prot.accept), and will need to be modified to match ker‐
20       nel changes.
21
22       This  tool only traces successful TCP accept()s. Connection attempts to
23       closed ports will not be shown (those can be  traced  via  other  func‐
24       tions).
25
26       Since this uses BPF, only the root user can use this tool.
27

REQUIREMENTS

29       CONFIG_BPF and bcc.
30

OPTIONS

32       -h     Print usage message.
33
34       -T     Include a time column on output (HH:MM:SS).
35
36       -t     Include a timestamp column.
37
38       -p PID Trace this process ID only (filtered in-kernel).
39
40       -P PORTS
41              Comma-separated  list  of local ports to trace (filtered in-ker‐
42              nel).
43
44       --cgroupmap MAPPATH
45              Trace cgroups in this BPF map only (filtered in-kernel).
46
47       --mntnsmap  MAPPATH
48              Trace mount namespaces in this BPF map  only  (filtered  in-ker‐
49              nel).
50

EXAMPLES

52       Trace all passive TCP connections (accept()s):
53              # tcpaccept
54
55       Trace all TCP accepts, and include timestamps:
56              # tcpaccept -t
57
58       Trace connections to local ports 80 and 81 only:
59              # tcpaccept -P 80,81
60
61       Trace PID 181 only:
62              # tcpaccept -p 181
63
64       Trace  a set of cgroups only (see special_filtering.md from bcc sources
65       for more details):
66              # tcpaccept --cgroupmap /sys/fs/bpf/test01
67

FIELDS

69       TIME   Time of the event, in HH:MM:SS format.
70
71       TIME(s)
72              Time of the event, in seconds.
73
74       PID    Process ID
75
76       COMM   Process name
77
78       IP     IP address family (4 or 6)
79
80       RADDR  Remote IP address.
81
82       RPORT  Remote port
83
84       LADDR  Local IP address.
85
86       LPORT  Local port
87

OVERHEAD

89       This traces the kernel inet_csk_accept function and prints  output  for
90       each event.  The rate of this depends on your server application. If it
91       is a web or proxy server accepting many tens of  thousands  of  connec‐
92       tions  per  second,  then  the  overhead of this tool may be measurable
93       (although, still a lot better than tracing every packet). If it is less
94       than  a thousand a second, then the overhead is expected to be negligi‐
95       ble. Test and understand this overhead before use.
96

SOURCE

98       This is from bcc.
99
100              https://github.com/iovisor/bcc
101
102       Also look in the bcc distribution for a  companion  _examples.txt  file
103       containing example usage, output, and commentary for this tool.
104

OS

106       Linux
107

STABILITY

109       Unstable - in development.
110

AUTHOR

112       Brendan Gregg
113