bcc-tcpconnlat(8)

1tcpconnlat(8)               System Manager's Manual              tcpconnlat(8)
2
3
4

NAME

6       tcpconnlat - Trace TCP active connection latency. Uses Linux eBPF/bcc.
7

SYNOPSIS

9       tcpconnlat [-h] [-t] [-p PID] [-L] [-v] [min_ms]
10

DESCRIPTION

12       This  tool traces active TCP connections (eg, via a connect() syscall),
13       and shows the latency (time) for the connection  as  measured  locally:
14       the  time  from SYN sent to the response packet.  This is a useful per‐
15       formance metric that typically spans kernel TCP/IP processing  and  the
16       network round trip time (not application runtime).
17
18       All  connection  attempts are traced, even if they ultimately fail (RST
19       packet in response).
20
21       This tool works by use of kernel dynamic tracing of  TCP/IP  functions,
22       and  will  need  updating to match any changes to these functions. This
23       tool should be updated in the future to use  static  tracepoints,  once
24       they are available.
25
26       Since this uses BPF, only the root user can use this tool.
27

REQUIREMENTS

29       CONFIG_BPF and bcc.
30

OPTIONS

32       -h     Print usage message.
33
34       -t     Include a timestamp column.
35
36       -p PID Trace this process ID only (filtered in-kernel).
37
38       -L     Include a LPORT column.
39
40       -v     Print the resulting BPF program, for debugging purposes.
41
42       min_ms Minimum duration to trace, in milliseconds.
43

EXAMPLES

45       Trace all active TCP connections, and show connection latency (SYN->re‐
46       sponse round trip):
47              # tcpconnlat
48
49       Include timestamps:
50              # tcpconnlat -t
51
52       Trace PID 181 only:
53              # tcpconnlat -p 181
54
55       Trace connects, and include LPORT:
56              # tcpconnlat -L
57
58       Trace connects with latency longer than 10 ms:
59              # tcpconnlat 10
60
61       Print the BPF program:
62              # tcpconnlat -v
63

FIELDS

65       TIME(s)
66              Time of the response packet, in seconds.
67
68       PID    Process ID that initiated the connection.
69
70       COMM   Process name that initiated the connection.
71
72       IP     IP address family (4 or 6).
73
74       SADDR  Source IP address.
75
76       DADDR  Destination IP address.
77
78       LPORT  Source port
79
80       DPORT  Destination port
81
82       LAT(ms)
83              The time from when a TCP connect was issued (measured in-kernel)
84              to  when a response packet was received for this connection (can
85              be SYN,ACK, or RST, etc).  This time spans kernel to kernel  la‐
86              tency,  involving kernel TCP/IP processing and the network round
87              trip in between. This typically does not include time  spent  by
88              the application processing the new connection.
89

OVERHEAD

91       This  traces  the  kernel tcp_v[46]_connect functions and prints output
92       for each event. As the rate of this is generally expected to be low  (<
93       1000/s), the overhead is also expected to be negligible. If you have an
94       application that is calling a high rate of connects()s, such as a proxy
95       server, then test and understand this overhead before use.
96

SOURCE

98       This is from bcc.
99
100              https://github.com/iovisor/bcc
101
102       Also  look  in  the bcc distribution for a companion _examples.txt file
103       containing example usage, output, and commentary for this tool.
104

OS

106       Linux
107

STABILITY

109       Unstable - in development.
110

AUTHOR

112       Brendan Gregg
113