tcpconnect.bt(8)

✨ NAME ✨

bestie, this is tcpconnect.bt(8) from the System Manager's Manual 💅 It's a tool that traces TCP active connections (connect()) and it's built on Linux bpftrace/eBPF 🔥

🌸 SYNOPSIS 🌸

tcpconnect.bt

💖 DESCRIPTION 💖

okay so this tool traces active TCP connections, aka the ones made through a connect() syscall 📞 accept() calls are passive connections, so they're not part of the party 🙅‍♀️ This is lowkey super useful for general troubleshooting when you wanna see what connections your local server is starting on its own ✨

All connection attempts get traced, even the ones that ultimately fail. no cap, the failures are the tea 🫖

It works by tracing the kernel tcp_v4_connect() and tcp_v6_connect() functions using dynamic tracing. Heads up: it will need updating if those functions ever change 🛠️

Since this uses BPF, only the root user can use this tool 👑 so no sneaking in as a regular user, periodt 🚫

🎀 REQUIREMENTS 🎀

You'll need CONFIG_BPF and bpftrace ✨

🦋 EXAMPLES 🦋

Trace all active TCP connections:

# tcpconnect.bt

💅 FIELDS 💅

Here's what each column is giving:

• TIME(s) — the time of the call, in HH:MM:SS format ⏰
• PID — the process ID 🆔
• COMM — the process name 🧚
• SADDR — the source IP address 📍
• SPORT — the source port 🚪
• DADDR — the destination IP address 🎯
• DPORT — the destination port 🔌

🔥 OVERHEAD 🔥

This traces the kernel tcp_v[46]_connect functions and prints output for each event. Since the rate is generally expected to be low (< 1000/s), the overhead should be negligible, so it's giving chill vibes 😌 BUT if you've got an application making a high rate of connect() calls, like a proxy server, then test and understand this overhead before you use it 🙈 bestie, don't skip this step.

🌈 SOURCE 🌈

This is from bpftrace, so go check out the repo at https://github.com/bpftrace/bpftrace 🔗

Also look in the bpftrace distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool 📚

This is the bpftrace version of the bcc tool with the same name. The bcc tool may provide more options and customizations, so if you need extra features, peek at https://github.com/iovisor/bcc 💜

🧚 OS 🧚

Linux 🐧

🙈 STABILITY 🙈

Unstable - in development. so, fair warning, it's still a work in progress 🚧

👑 AUTHOR 👑

Brendan Gregg, adapted for bpftrace by Dale Hamel 🫶

✨ SEE ALSO ✨

tcpaccept.bt(8), funccount(8), tcpdump(8) 💖

---

Bestie, that's the whole page. It's from USER COMMANDS, dated 2018-11-24, and it's the tcpconnect.bt(8) manual 🎀 Slay the troubleshooting, and don't forget to be root 👑💅