bcc-tcpdrop(8)

1tcpdrop(8)                  System Manager's Manual                 tcpdrop(8)
2
3
4

NAME

6       tcpdrop  - Trace kernel-based TCP packet drops with details. Uses Linux
7       eBPF/bcc.
8

SYNOPSIS

10       tcpdrop [-4 | -6] [-h]
11

DESCRIPTION

13       This tool traces TCP packets or segments that were dropped by the  ker‐
14       nel,  and  shows details from the IP and TCP headers, the socket state,
15       and the kernel stack trace. This is useful for debugging cases of  high
16       kernel  drops,  which can cause timer-based retransmits and performance
17       issues.
18
19       This tool works using dynamic tracing of the  tcp_drop()  kernel  func‐
20       tion, which requires a recent kernel version.
21
22       Since this uses BPF, only the root user can use this tool.
23

REQUIREMENTS

25       CONFIG_BPF and bcc.
26

OPTIONS

28       -4     Trace IPv4 family only.
29
30       -6     Trace IPv6 family only.
31
32       -h     Print usage message.
33

EXAMPLES

35       Trace kernel-based TCP packet drops with details:
36              # tcpdrop
37
38       Trace IPv4 family only:
39              # tcpdrop -4
40
41       Trace IPv6 family only:
42              # tcpdrop -6
43

FIELDS

45       TIME   Time of the drop, in HH:MM:SS format.
46
47       PID    Process  ID  that  was on-CPU during the drop. This may be unre‐
48              lated, as drops can occur on the receive interrupt and be  unre‐
49              lated to the PID that was interrupted.
50
51       IP     IP address family (4 or 6)
52
53       SADDR  Source IP address.
54
55       SPORT  Source TCP port.
56
57       DADDR  Destination IP address.
58
59       DPORT  Destionation TCP port.
60
61       STATE  TCP session state ("ESTABLISHED", etc).
62
63       FLAGS  TCP flags ("SYN", etc).
64

OVERHEAD

66       This  traces  the  kernel tcp_drop() function, which should be low fre‐
67       quency, and therefore the overhead of this tool should be negligible.
68
69       As always, test and understand this tools overhead for  your  types  of
70       workloads before production use.
71

SOURCE

73       This is from bcc.
74
75              https://github.com/iovisor/bcc
76
77       Also  look  in  the bcc distribution for a companion _examples.txt file
78       containing example usage, output, and commentary for this tool.
79

OS

81       Linux
82

STABILITY

84       Unstable - in development.
85

AUTHOR

87       Brendan Gregg
88