tcpconnlat(8)

✨ tcpconnlat(8) ✨

System Manager's Manual 💅 this is the page for tcpconnlat, and it's giving main character energy 🎀

🫶 NAME

tcpconnlat - Trace TCP active connection latency. Uses Linux eBPF/bcc. 🦋

📜 SYNOPSIS

tcpconnlat [-h] [-t] [-p PID] [-L] [-4 | -6] [-v] [min_ms]

💖 DESCRIPTION

okay so tcpconnlat traces active TCP connections (think connect() syscalls) and shows the latency for each one, as measured locally. That's the time from when the SYN gets sent to when the response packet comes back 🌸 It's a super useful performance metric, because it usually covers kernel TCP/IP processing plus the network round trip. It does not count how long your app spends running, so don't blame the app for network stuff 🙈

Every connection attempt gets traced, even the ones that ultimately fail (an RST packet coming back in response) ✨

Lowkey, the tool works through kernel dynamic tracing of TCP/IP functions, so it'll need updating whenever those functions change. It should switch to static tracepoints in the future, once they're available 🧚

💀 Since this uses BPF, only the root user can use this tool. No exceptions, bestie.

🎀 REQUIREMENTS

You'll need CONFIG_BPF and bcc 🔥

✨ OPTIONS ✨

• -h — Prints the usage message 📖
• -t — Adds a timestamp column 🕰️
• -p PID — Only traces this process ID, filtered in-kernel 🎯
• -L — Adds an LPORT column 🌈
• -4 — IPv4 family only 🌸
• -6 — IPv6 family only 🦋
• -v — Prints the resulting BPF program, for debugging 🙈
• min_ms — The minimum duration to trace, in milliseconds ⭐

🍓 EXAMPLES

Trace all active TCP connections and show connection latency (SYN->response round trip):

# tcpconnlat

Include timestamps:

# tcpconnlat -t

Trace PID 181 only:

# tcpconnlat -p 181

Trace connects and include LPORT:

# tcpconnlat -L

Trace IPv4 family only:

# tcpconnlat -4

Trace IPv6 family only:

# tcpconnlat -6

Trace connects with latency longer than 10 ms:

# tcpconnlat 10

Print the BPF program:

# tcpconnlat -v

🔥 FIELDS

• TIME(s) — When the response packet showed up, in seconds ⏰
• PID — The process ID that started the connection 🧚
• COMM — The process name that started the connection 💜
• IP — The IP address family (4 or 6) 🌐
• SADDR — Source IP address 🫶
• DADDR — Destination IP address 💌
• LPORT — Source port 🦋
• DPORT — Destination port 🌸
• LAT(ms) — The time from when a TCP connect was issued (measured in-kernel) until a response packet came back for that connection. That response can be SYN,ACK, RST, etc. This spans kernel-to-kernel latency, so it includes kernel TCP/IP processing and the network round trip in between. It usually does not include time the application spends handling the new connection ✨

🌈 OVERHEAD

This traces the kernel tcp_v[46]_connect functions and prints output for each event. Since the rate is generally expected to be low (< 1000/s), the overhead should be negligible 💅 But if you've got an app making a high rate of connect()s, like a proxy server, test and understand the overhead before using it 😭

🍓 SOURCE

This is from bcc 🫶

https://github.com/iovisor/bcc

Also check out the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool 📚

🖥️ OS

Linux 🐧

🚧 STABILITY

Unstable, still in development 🙈

👑 AUTHOR

Brendan Gregg 💖

🦋 SEE ALSO

tcpconnect(8), tcpaccept(8), funccount(8), tcpdump(8) 💜

---

Okay bestie that's the whole tea ☕💖 This page came from the USER COMMANDS set, dated 2016-02-19, and it's all about tcpconnlat(8). Stay iconic, and don't forget your root privileges 🎀✨