tcpdrop(8)

💖 tcpdrop(8) 💖

✨ NAME ✨

okay so the name of this bad boy is tcpdrop 🦋 It's a tool that traces kernel-based TCP packet drops with details. It runs on Linux eBPF/bcc, so it's giving low-level tea ☕

🎀 SYNOPSIS 🎀

tcpdrop [-4 | -6] [-h]

🌸 DESCRIPTION 🌸

bestie, this tool catches TCP packets or segments that the kernel dropped 😭 and shows you everything: details from the IP and TCP headers, the socket state, and the kernel stack trace. It's lowkey essential for debugging high kernel drops, because those can cause timer-based retransmits and performance issues. Not me losing sleep over this 💀

This tool works by dynamically tracing the tcp_drop() kernel function, so you'll need a recent kernel version 🧚

Since it uses BPF, only the root user can run it 👑 sorry, no cap, that's the rule.

🍓 REQUIREMENTS 🍓

You need CONFIG_BPF and bcc. No shortcuts 💅

✨ OPTIONS ✨

• -4 — trace the IPv4 family only 🌈
• -6 — trace the IPv6 family only 🌈
• -h — print the usage message 🫶

🧚 EXAMPLES 🧚

Trace kernel-based TCP packet drops with details:

# tcpdrop

Trace IPv4 family only:

# tcpdrop -4

Trace IPv6 family only:

# tcpdrop -6

💜 FIELDS 💜

• TIME — when the drop happened, in HH:MM:SS format ⏰
• PID — the process ID that was on-CPU during the drop. Heads up, this may be unrelated 🙈 drops can happen on the receive interrupt, so the PID that got interrupted isn't always the culprit.
• IP — the IP address family (4 or 6)
• SADDR — the source IP address
• SPORT — the source TCP port
• DADDR — the destination IP address
• DPORT — the destination TCP port
• STATE — the TCP session state, like "ESTABLISHED", etc.
• FLAGS — the TCP flags, like "SYN", etc.

🌈 OVERHEAD 🌈

This traces the kernel tcp_drop() function, which should be low frequency, so the overhead of this tool should be negligible. Lowkey vibes ✨

As always, test and understand this tool's overhead for your type of workload before you use it in production 🫶 future you will thank you.

🔥 SOURCE 🔥

This is from bcc, check it out:

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool, and it's giving main character energy 🎀

🌷 OS 🌷

Linux 🐧

🙈 STABILITY 🙈

Unstable, it's still in development 🚧 so don't be shocked if things shift.

👑 AUTHOR 👑

Brendan Gregg 💅

🦋 SEE ALSO 🦋

tcplife(8), tcpaccept(8), tcpconnect(8), tcptop(8) — iykyk 💜

---

Bestie, that's the whole tea ☕ This page is from the USER COMMANDS section, last updated 2018-05-30, and it's all yours to read as tcpdrop(8) 🫶✨