bcc-tcpretrans(8)

1tcpretrans(8)               System Manager's Manual              tcpretrans(8)
2
3
4

NAME

6       tcpretrans  -  Trace  or  count  TCP  retransmits  and TLPs. Uses Linux
7       eBPF/bcc.
8

SYNOPSIS

10       tcpretrans [-h] [-s] [-l] [-c] [-4 | -6]
11

DESCRIPTION

13       This traces TCP retransmits, showing address, port, and TCP  state  in‐
14       formation,  and sometimes the PID (although usually not, since retrans‐
15       mits are usually sent by the kernel on timeouts). To keep overhead very
16       low,  only the TCP retransmit functions are traced. This does not trace
17       every packet (like tcpdump(8) or a packet sniffer). Optionally, it  can
18       count  retransmits  over  a user signalled interval to spot potentially
19       dropping network paths the flows are traversing.
20
21       This uses  dynamic  tracing  of  the  kernel  tcp_retransmit_skb()  and
22       tcp_send_loss_probe()  functions,  and will need to be updated to match
23       kernel changes to these functions.
24
25       Since this uses BPF, only the root user can use this tool.
26

REQUIREMENTS

28       CONFIG_BPF and bcc.
29

OPTIONS

31       -h     Print usage message.
32
33       -s     Display TCP sequence numbers.
34
35       -l     Include tail loss probe attempts (in some cases the  kernel  may
36              not complete the TLP send).
37
38       -c     Count occurring retransmits per flow.
39
40       -4     Trace IPv4 family only.
41
42       -6     Trace IPv6 family only.
43

EXAMPLES

45       Trace TCP retransmits:
46              # tcpretrans
47
48       Trace TCP retransmits and TLP attempts:
49              # tcpretrans -l
50
51       Trace IPv4 family only:
52              # tcpretrans -4
53
54       Trace IPv6 family only:
55              # tcpretrans -6
56

FIELDS

58       TIME   Time of the retransmit.
59
60       PID    Process  ID  that  was on-CPU. This is less useful than it might
61              sound, as it may usually be 0, for the kernel,  for  timer-based
62              retransmits.
63
64       IP     IP address family (4 or 6).
65
66       LADDR  Local IP address.
67
68       LPORT  Local port.
69
70       T>     Type of event: R> == retransmit, L> == tail loss probe.
71
72       RADDR  Remote IP address.
73
74       RPORT  Remote port.
75
76       STATE  TCP session state.
77
78       SEQ    TCP sequence.
79
80       RETRANSMITS
81              Accumulated occurred retransmits since start.
82

OVERHEAD

84       Should  be  negligible:  TCP retransmit events should be low (<1000/s),
85       and the low overhead this tool adds to each event should make the  cost
86       negligible.
87

SOURCE

89       This is from bcc.
90
91              https://github.com/iovisor/bcc
92
93       Also  look  in  the bcc distribution for a companion _examples.txt file
94       containing example usage, output, and commentary for this tool.
95

OS

97       Linux
98

STABILITY

100       Unstable - in development.
101

AUTHOR

103       Brendan Gregg
104