tcpdrop.bt(8)

💅 tcpdrop.bt(8) — like, the manual page bestie

okay so this is tcpdrop.bt from the System Manager's Manual, and it's genuinely one of my faves, no cap. it traces kernel-based TCP packet drops, with details, using Linux bpftrace/eBPF. 🦋

---

✨ NAME ✨

tcpdrop.bt — trace kernel-based TCP packet drops with details. Uses Linux bpftrace/eBPF. periodt. 💅

---

🌸 SYNOPSIS 🌸

tcpdrop.bt

that's it. that's the whole vibe. she takes no args and she takes no nonsense. 🎀

---

💖 DESCRIPTION 💖

so basically, this tool traces TCP packets or segments that the kernel dropped — and then it shows you the receipts: details from the IP and TCP headers, the socket state, and the kernel stack trace. it's giving detective energy fr fr. 🔍

why do you care? because when you're debugging cases of high kernel drops, this is the tool. high drops can cause timer-based retransmits and performance issues, and nobody wants that. 😭

the way this works is dynamic tracing of the tcp_drop() kernel function, which means it requires a recent kernel version. no old-kernel shenanigans here bestie. 👑

⚠️ this tool is limited to ipv4, and it cannot parse tcpflags — because bpftrace currently cannot parse socket buffers in the way that bcc can. not her fault, she's just built different (and that difference has limits). 💀

🔒 since this uses BPF, only the root user can use this tool. like, root only. don't even try it as a regular user, she will simply not let you. 🙈

---

🧚 REQUIREMENTS 🧚

• CONFIG_BPF
• bpftrace

both of them. together. a duo. an iconic pair. ✨

---

🌈 EXAMPLES 🌈

trace all tcp drops:

# tcpdrop.bt

literally that's the whole command. main character energy with zero effort. 💅

---

🍓 FIELDS 🍓

here's what all those columns mean, bestie, so you're not squinting at your terminal like 👁️👄👁️

• TIME — time of the call, in HH:MM:SS format. cute, precise, clocked in.
• PID — process ID that was on-CPU during the drop. lowkey important caveat: this may be unrelated, because drops can occur on the receive interrupt and be unrelated to the PID that was interrupted. so don't go blaming that process, she said what she said. 🙈
• COMM — process name.
• SADDR:SPORT — source IP address and source TCP port.
• DADDR:DPORT — destination IP address and destination TCP port.
• STATE — TCP session state ("ESTABLISHED", etc). yes like that. the whole vibe of the connection, summarized. 💜

---

🔥 OVERHEAD 🔥

this traces the kernel tcp_drop() function, which should be low frequency — so therefore the overhead of this tool should be negligible. she's light on her feet. 🦋

but as always, bestie: test and understand this tool's overhead for your types of workloads before production use. don't just yolo it into prod, I'm begging. 😭

---

📚 SOURCE 📚

this is from bpftrace:

https://github.com/bpftrace/bpftrace

also, look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. it's like the director's commentary track but for syscalls. 🎀

and fun fact: this is a bpftrace version of the bcc tool of the same name. the bcc tool may provide more options and customizations, so if you need more, go say hi to her cousin:

https://github.com/iovisor/bcc

---

🐧 OS 🐧

Linux. that's the one. 🌸

---

⭐ STABILITY ⭐

Unstable — in development. she's a work in progress and she's thriving. treat her accordingly. 💅

---

👑 AUTHOR 👑

Brendan Gregg, adapted for bpftrace by Dale Hamel. legends, both of them. 🫶

---

🔗 SEE ALSO 🔗

tcplife.bt(8), tcpaccept.bt(8), tcpconnect.bt(8), tcptop(8)

the whole friend group honestly. go read them too. 💖

---

and that's the whole page bestie!! ✨ this one lives under USER COMMANDS and it's dated 2018-11-24 — a classic, an icon, a moment. mwah. 💅🎀💖