tcplife(8)

1tcplife(8)                  System Manager's Manual                 tcplife(8)
2
3
4

NAME

6       tcplife  -  Trace  TCP  session lifespans with connection details. Uses
7       bpftrace/eBPF.
8

SYNOPSIS

10       tcplife
11

DESCRIPTION

13       This tool shows the lifespan of TCP sessions that open and close  while
14       tracing,  and  shows  the duration and throughput statistics. For effi‐
15       ciency, this tool only instruments TCP state changes, rather  than  all
16       packets.
17
18       This tool works by using the sock:inet_sock_set_state tracepoint, which
19       was added in Linux 4.16.
20
21       Since this uses BPF, only the root user can use this tool.
22

REQUIREMENTS

24       CONFIG_BPF,  bpftrace,  and  the  sock:inet_sock_set_state   tracepoint
25       (Linux 4.16+).
26

EXAMPLES

28       Show TCP sessions with details:
29              # tcplife.bt
30

FIELDS

32       PID    Process ID
33
34       COMM   Process name
35
36       LADDR  Local IP address.
37
38       DADDR  Remote IP address.
39
40       LPORT  Local port.
41
42       RPORT  Remote port.
43
44       TX_KB  Total transmitted Kbytes.
45
46       RX_KB  Total received Kbytes.
47
48       MS     Lifespan of the session, in milliseconds.
49

OVERHEAD

51       This  traces  the kernel TCP set state function, which should be called
52       much less often than send/receive tracing,  and  therefore  have  lower
53       overhead.  The  overhead of the tool is relative to the rate of new TCP
54       sessions: if this is high, over 10,000 per second, then  there  may  be
55       noticeable overhead just to print out 10k lines of formatted output per
56       second.
57
58       You can find out the rate of new TCP sessions using "sar -n TCP 1", and
59       adding the active/s and passive/s columns.
60
61       As  always,  test  and understand this tools overhead for your types of
62       workloads before production use.
63

SOURCE

65       This tool originated from BCC:
66
67              https://github.com/iovisor/bcc
68
69       The BCC version has many command line options for customizing the  out‐
70       put.
71
72       This bpftrace version originated from the book "BPF Performance Tools",
73       published by Addison Wesley (2019):
74
75              http://www.brendangregg.com/bpf-performance-tools-book.html
76
77       See the book for more documentation on this tool.
78
79       This bpftrace version is in the bpftrace repository:
80
81              https://github.com/iovisor/bpftrace
82
83       Also look in the bpftrace distribution for  a  companion  _examples.txt
84       file containing example usage, output, and commentary for this tool.
85

OS

87       Linux
88

STABILITY

90       Unstable - in development.
91

AUTHOR

93       Brendan Gregg
94