bcc-tcpsubnet(8)

1tcpsubnet(8)                System Manager's Manual               tcpsubnet(8)
2
3
4

NAME

6       tcpsubnet - Summarize and aggregate IPv4 TCP traffic by subnet.
7

SYNOPSIS

9       tcpsubnet [-h] [-v] [--ebpf] [-J] [-f FORMAT] [-i INTERVAL] [subnets]
10

DESCRIPTION

12       This tool summarizes and aggregates IPv4 TCP sent to the subnets passed
13       in argument and prints to stdout on a fixed interval.
14
15       This uses dynamic tracing of kernel  TCP  send/receive  functions,  and
16       will need to be updated to match kernel changes.
17
18       The traced data is summarized in-kernel using a BPF map to reduce over‐
19       head.  At very high TCP event rates, the overhead may still be  measur‐
20       able.  See the OVERHEAD section for more details.
21
22       Since this uses BPF, only the root user can use this tool.
23

REQUIREMENTS

25       CONFIG_BPF and bcc.
26

OPTIONS

28       -h     Print USAGE message.
29
30       -v     Run  in  verbose mode. Will output subnet evaluation and the BPF
31              program
32
33       -J     Format output in JSON.
34
35       -i     Interval between updates, seconds (default 1).
36
37       -f     Format output units. Supported values  are  bkmBKM.  When  using
38              kmKM the output will be rounded to floor.
39
40       --ebpf Prints the BPF program.
41
42       subnets
43              Comma  separated list of subnets. Traffic will be categorized in
44              theses       subnets.       Order       matters.        (default
45              127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,0.0.0.0/0)
46

EXAMPLES

48       Summarize TCP traffic by the default subnets:
49              # tcpsubnet
50
51       Summarize all TCP traffic:
52              # tcpsubnet 0.0.0.0/0
53
54       Summarize all TCP traffic and output in JSON and Kb:
55              # tcpsubnet -J -fk 0.0.0.0/0
56

FIELDS

58       (Standad output) Left hand side column:
59              Subnet
60
61       (Standard output) Right hand side column:
62              Aggregate traffic in units passed as argument
63
64       (JSON output) date
65              Current date formatted in the system locale
66
67       (JSON output) time
68              Current time formatted in the system locale
69
70       (JSON output) entries
71              Map of subnets to aggregates. Values will be in format passed to
72              -f
73

OVERHEAD

75       This traces all tcp_sendmsg function calls in  the  TCP/IP  stack.   It
76       summarizes  data  in-kernel  to  reduce  overhead.  A simple iperf test
77       (v2.0.5) with the default values shows a loss of ~5% throughput. On  10
78       runs  without  tcpsubnet  running the average throughput was 32.42Gb/s,
79       with tcpsubnet enabled it was 31.26Gb/s.  This is not meant to be  used
80       as  a  long  running  service. Use it for troubleshooting or for a con‐
81       trolled interval. As always, try it out in a test environment first.
82
83

SOURCE

85       This is from bcc.
86
87              https://github.com/iovisor/bcc
88
89       Also look in the bcc distribution for a  companion  _examples.txt  file
90       containing example usage, output, and commentary for this tool.
91

OS

93       Linux
94

STABILITY

96       Unstable - in development.
97

AUTHOR

99       Rodrigo Manyari
100

INSPIRATION

102       tcptop(8) by Brendan Gregg
103