1tcpsubnet(8) System Manager's Manual tcpsubnet(8)
2
3
4
6 tcpsubnet - Summarize and aggregate IPv4 TCP traffic by subnet.
7
9 tcpsubnet [-h] [-v] [-J] [-f FORMAT] [-i INTERVAL] [subnets]
10
12 This tool summarizes and aggregates IPv4 TCP sent to the subnets passed
13 in argument and prints to stdout on a fixed interval.
14
15 This uses dynamic tracing of kernel TCP send/receive functions, and
16 will need to be updated to match kernel changes.
17
18 The traced data is summarized in-kernel using a BPF map to reduce over‐
19 head. At very high TCP event rates, the overhead may still be measur‐
20 able. See the OVERHEAD section for more details.
21
22 Since this uses BPF, only the root user can use this tool.
23
25 CONFIG_BPF and bcc.
26
28 -h Print USAGE message.
29
30 -v Run in verbose mode. Will output subnet evaluation and the BPF
31 program
32
33 -J Format output in JSON.
34
35 -i Interval between updates, seconds (default 1).
36
37 -f Format output units. Supported values are bkmBKM. When using
38 kmKM the output will be rounded to floor.
39
40 subnets
41 Comma separated list of subnets. Traffic will be categorized in
42 theses subnets. Order matters. (default
43 127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,0.0.0.0/0)
44
46 Summarize TCP traffic by the default subnets:
47 # tcpsubnet
48
49 Summarize all TCP traffic:
50 # tcpsubnet 0.0.0.0/0
51
52 Summarize all TCP traffic and output in JSON and Kb:
53 # tcpsubnet -J -fk 0.0.0.0/0
54
56 (Standad output) Left hand side column:
57 Subnet
58
59 (Standard output) Right hand side column:
60 Aggregate traffic in units passed as argument
61
62 (JSON output) date
63 Current date formatted in the system locale
64
65 (JSON output) time
66 Current time formatted in the system locale
67
68 (JSON output) entries
69 Map of subnets to aggregates. Values will be in format passed to
70 -f
71
73 This traces all tcp_sendmsg function calls in the TCP/IP stack. It
74 summarizes data in-kernel to reduce overhead. A simple iperf test
75 (v2.0.5) with the default values shows a loss of ~5% throughput. On 10
76 runs without tcpsubnet running the average throughput was 32.42Gb/s,
77 with tcpsubnet enabled it was 31.26Gb/s. This is not meant to be used
78 as a long running service. Use it for troubleshooting or for a con‐
79 trolled interval. As always, try it out in a test environment first.
80
81
83 This is from bcc.
84
85 https://github.com/iovisor/bcc
86
87 Also look in the bcc distribution for a companion _examples.txt file
88 containing example usage, output, and commentary for this tool.
89
91 Linux
92
94 Unstable - in development.
95
97 Rodrigo Manyari
98
100 tcptop(8) by Brendan Gregg
101
103 netlink(7)
104
105
106
107USER COMMANDS 2018-03-01 tcpsubnet(8)