tcpaccept.bt(8)

🎀 tcpaccept.bt 🎀

✨ NAME ✨

okay so the manual name is tcpaccept.bt (section 8) and it's giving trace TCP passive connections (accept()) 💅 it uses bpftrace/eBPF under the hood, obsessed 🔥

tcpaccept.bt

---

👑 SYNOPSIS 👑

Just type the name, that's the whole spell ✨

tcpaccept.bt

---

💖 DESCRIPTION 💖

okay bestie, this tool traces passive TCP connections (like the ones from an accept() syscall). connect() calls are the active ones, so they're not the vibe here 🙈 It's super useful for general troubleshooting when you wanna see what new connections your local server is accepting, iconic 🦋

It works by dynamic tracing of the kernel inet_csk_accept() socket function (the one from tcp_prot.accept). ⚠️ Heads up, it'll need to be modified to match kernel changes, so don't be shocked if it needs a glow-up later 🧚

Also, this tool only catches successful TCP accept()s. Connection attempts to closed ports won't show up, so if you need those, you gotta trace them with other functions 💀

And because it uses BPF, only the root user can run it. No sneaking in 🔒

---

🌸 REQUIREMENTS 🌸

You need CONFIG_BPF and bpftrace. Non-negotiable, periodt 💅

---

🎀 EXAMPLES 🎀

Trace all passive TCP connections (accept()s):

# tcpaccept.bt

---

🦋 FIELDS 🦋

Here's what the output columns mean, no cap:

• TIME(s) — Time of the call, in HH:MM:SS format.
• PID — Process ID.
• COMM — Process name.
• RADDR — Remote IP address.
• RPORT — Remote port.
• LADDR — Local IP address.
• LPORT — Local port
• BL — Current accept backlog vs maximum backlog

---

🧚 OVERHEAD 🧚

This one traces the kernel inet_csk_accept function and prints output for every single event. How much it costs you depends on your server app, bestie. If it's a web or proxy server accepting many tens of thousands of connections per second, the overhead might be measurable (though honestly still way better than tracing every packet 😭). If it's less than a thousand a second, the overhead is expected to be negligible ✨ Test it and understand the overhead before you use it, fr fr 🫶

---

🌈 SOURCE 🌈

This one's from bpftrace, go check it out 💜

https://github.com/bpftrace/bpftrace

Also peek in the bpftrace distribution for a companion _examples.txt file with example usage, output, and commentary for this tool. It's giving extra credit 📚

It's a bpftrace version of the bcc tool of the same name. The bcc tool might have more options and customizations, so if you're craving more, go there 🍓

https://github.com/iovisor/bcc

---

💅 OS 💅

Linux, obviously 🐧

---

🙈 STABILITY 🙈

Unstable - in development. It's still cooking, so be gentle 🍳

---

🔥 AUTHOR 🔥

Brendan Gregg, adapted for bpftrace by Dale Hamel. Iconic duo, literally ⭐

---

⭐ SEE ALSO ⭐

Check out tcpconnect.bt(8), funccount(8), and tcpdump(8) for more tea ☕

---

🫶 Okay bestie, that's the whole page! Bye bye, from the USER COMMANDS section, dated 2018-10-24, all about tcpaccept.bt(8) 💖✨