bcc-tcpconnlat(8)

1tcpconnlat(8)               System Manager's Manual              tcpconnlat(8)
2
3
4

NAME

6       tcpconnlat - Trace TCP active connection latency. Uses Linux eBPF/bcc.
7

SYNOPSIS

9       tcpconnlat [-h] [-t] [-p PID] [-L] [-4 | -6] [-v] [min_ms]
10

DESCRIPTION

12       This  tool traces active TCP connections (eg, via a connect() syscall),
13       and shows the latency (time) for the connection  as  measured  locally:
14       the  time  from SYN sent to the response packet.  This is a useful per‐
15       formance metric that typically spans kernel TCP/IP processing  and  the
16       network round trip time (not application runtime).
17
18       All  connection  attempts are traced, even if they ultimately fail (RST
19       packet in response).
20
21       This tool works by use of kernel dynamic tracing of  TCP/IP  functions,
22       and  will  need  updating to match any changes to these functions. This
23       tool should be updated in the future to use  static  tracepoints,  once
24       they are available.
25
26       Since this uses BPF, only the root user can use this tool.
27

REQUIREMENTS

29       CONFIG_BPF and bcc.
30

OPTIONS

32       -h     Print usage message.
33
34       -t     Include a timestamp column.
35
36       -p PID Trace this process ID only (filtered in-kernel).
37
38       -L     Include a LPORT column.
39
40       -4     Trace IPv4 family only.
41
42       -6     Trace IPv6 family only.
43
44       -v     Print the resulting BPF program, for debugging purposes.
45
46       min_ms Minimum duration to trace, in milliseconds.
47

EXAMPLES

49       Trace all active TCP connections, and show connection latency (SYN->re‐
50       sponse round trip):
51              # tcpconnlat
52
53       Include timestamps:
54              # tcpconnlat -t
55
56       Trace PID 181 only:
57              # tcpconnlat -p 181
58
59       Trace connects, and include LPORT:
60              # tcpconnlat -L
61
62       Trace IPv4 family only:
63              # tcpconnlat -4
64
65       Trace IPv6 family only:
66              # tcpconnlat -6
67
68       Trace connects with latency longer than 10 ms:
69              # tcpconnlat 10
70
71       Print the BPF program:
72              # tcpconnlat -v
73

FIELDS

75       TIME(s)
76              Time of the response packet, in seconds.
77
78       PID    Process ID that initiated the connection.
79
80       COMM   Process name that initiated the connection.
81
82       IP     IP address family (4 or 6).
83
84       SADDR  Source IP address.
85
86       DADDR  Destination IP address.
87
88       LPORT  Source port
89
90       DPORT  Destination port
91
92       LAT(ms)
93              The time from when a TCP connect was issued (measured in-kernel)
94              to  when a response packet was received for this connection (can
95              be SYN,ACK, or RST, etc).  This time spans kernel to kernel  la‐
96              tency,  involving kernel TCP/IP processing and the network round
97              trip in between. This typically does not include time  spent  by
98              the application processing the new connection.
99

OVERHEAD

101       This  traces  the  kernel tcp_v[46]_connect functions and prints output
102       for each event. As the rate of this is generally expected to be low  (<
103       1000/s), the overhead is also expected to be negligible. If you have an
104       application that is calling a high rate of connects()s, such as a proxy
105       server, then test and understand this overhead before use.
106

SOURCE

108       This is from bcc.
109
110              https://github.com/iovisor/bcc
111
112       Also  look  in  the bcc distribution for a companion _examples.txt file
113       containing example usage, output, and commentary for this tool.
114

OS

116       Linux
117

STABILITY

119       Unstable - in development.
120

AUTHOR

122       Brendan Gregg
123