tcpaccept(8)

🎀 tcpaccept(8) 🎀

System Manager's Manual 💅

✨ NAME ✨

tcpaccept — okay so this one traces TCP passive connections (the accept() ones) 🦋 It's Linux-only and uses eBPF/bcc 💜

🧚 SYNOPSIS ✨

tcpaccept [-h] [-T] [-t] [-p PID] [-P PORTS] [-4 | -6] [--cgroupmap
MAPPATH] [--mntnsmap MAPPATH]

💖 DESCRIPTION ✨

Bestie, this tool traces passive TCP connections, meaning the ones that come in through an accept() syscall. (connect() is the active side, so it's not included 🙈) It's giving very useful for general troubleshooting, because you can see every new connection your local server is accepting 👑

This works by dynamic tracing of the kernel inet_csk_accept() socket function (from tcp_prot.accept). It'll need to be modified to match kernel changes, so keep that in mind 🔧

Only successful TCP accept()s get traced. Connection attempts to closed ports won't show up here 💀 (you can trace those with other functions, though).

Since this uses BPF, only the root user can use this tool. No cap, that's a hard rule 🔒

🌸 REQUIREMENTS ✨

You'll need CONFIG_BPF and bcc 🍓

🎀 OPTIONS ✨

• -h — print the usage message 📖
• -T — include a time column on the output, formatted as HH:MM:SS ⏰
• -t — include a timestamp column 🕰️
• -p PID — trace only this process ID (filtered in-kernel) 🎯
• -P PORTS — trace only these local ports, given as a comma-separated list (filtered in-kernel) 🔌
• -4 — trace the IPv4 family only 🌐
• -6 — trace the IPv6 family only 🌍
• --cgroupmap MAPPATH — trace only the cgroups in this BPF map (filtered in-kernel) 🫧
• --mntnsmap MAPPATH — trace only the mount namespaces in this BPF map (filtered in-kernel) 🧩

🦋 EXAMPLES ✨

Trace all passive TCP connections (accept()s):

# tcpaccept

Trace all TCP accepts, and include timestamps:

# tcpaccept -t

Trace connections to local ports 80 and 81 only:

# tcpaccept -P 80,81

Trace PID 181 only:

# tcpaccept -p 181

Trace IPv4 family only:

# tcpaccept -4

Trace IPv6 family only:

# tcpaccept -6

Trace a set of cgroups only (see special_filtering.md from the bcc sources for more details):

# tcpaccept --cgroupmap /sys/fs/bpf/test01

🧾 FIELDS ✨

• TIME — time of the event, in HH:MM:SS format ⏱️
• TIME(s) — time of the event, in seconds 🕐
• PID — process ID 🆔
• COMM — process name 🏷️
• IP — IP address family (4 or 6) 🌈
• RADDR — remote IP address 📍
• RPORT — remote port 🚪
• LADDR — local IP address 🏠
• LPORT — local port 🔑

🐢 OVERHEAD ✨

This traces the kernel inet_csk_accept function and prints output for each event. How much it costs depends on your server app. If it's a web or proxy server accepting many tens of thousands of connections per second, the overhead can be measurable (still way better than tracing every packet, though 😌). If it's under a thousand a second, the overhead is expected to be negligible. Test it and understand the overhead before you use it in real life 🫶

🌷 SOURCE ✨

This is from bcc 🐝

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool 📚

💻 OS ✨

Linux 🐧

🧪 STABILITY ✨

Unstable — still in development 🚧

👩‍💻 AUTHOR ✨

Brendan Gregg 👑

🔗 SEE ALSO ✨

tcptracer(8), tcpconnect(8), funccount(8), tcpdump(8) 💜

---

Sign-off time! 🌈 This page is from USER COMMANDS, dated 2020-02-20, and it's the tcpaccept(8) page. Now go trace some accepts, bestie 💅✨🫶