tcplife.bt(8)

📦
version 0.27.0 · 4 versions
, in alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, nixos 26.05, nixpkgs unstable, ubuntu resolute, ubuntu stonking

✨ tcplife.bt — the manual page, but make it cute ✨

okay bestie, so this is tcplife.bt(8) from the System Manager's Manual, and it's literally the most main-character way to watch TCP sessions be born and die. let's get into it 💖

🌸 NAME 🌸

tcplife.bt — trace TCP session lifespans with connection details. uses bpftrace/eBPF. no cap.

🎀 SYNOPSIS 🎀

tcplife

that's it. that's the whole vibe. one word and she's off 🦋

💅 DESCRIPTION 💅

so this tool shows you the lifespan of TCP sessions that open and close while tracing, plus the duration and throughput statistics. it's giving full glow-up, full lifecycle, start to finish 💖

and because it's efficient (she's not doing the most, she's doing the right amount), this tool only instruments TCP state changes, rather than all packets. obsessed.

the way it works: it uses the sock:inet_sock_set_state tracepoint, which was added in Linux 4.16. periodt.

Since this uses BPF, only the root user can use this tool. like, root or nothing, bestie. 🙈

⭐ REQUIREMENTS ⭐

  • CONFIG_BPF
  • bpftrace
  • the sock:inet_sock_set_state tracepoint (Linux 4.16+)

that's the whole checklist, you got this 🫶

🌈 EXAMPLES 🌈

show TCP sessions with details:

# tcplife.bt

boom. iconic. ✨

🔥 FIELDS 🔥

here's the tea on every column she prints:

  • PID — Process ID
  • COMM — Process name
  • LADDR — Local IP address.
  • LPORT — Local port.
  • RADDR — Remote IP address.
  • RPORT — Remote port.
  • TX_KB — Total transmitted Kbytes.
  • RX_KB — Total received Kbytes.
  • MS — Lifespan of the session, in milliseconds.

nine columns of pure information 💅

💀 OVERHEAD 💀

ngl, this one matters. this traces the kernel TCP set state function, which should be called much less often than send/receive tracing, and therefore has lower overhead. so like, lowkey chill.

but the overhead of the tool is relative to the rate of new TCP sessions: if this is high, over 10,000 per second, then there may be noticeable overhead just to print out 10k lines of formatted output per second. that's a LOT of lines, bestie, she's typing as fast as she can 😭

you can find out the rate of new TCP sessions using "sar -n TCP 1", and adding the active/s and passive/s columns. do the math, it's giving arithmetic.

As always, test and understand this tools overhead for your types of workloads before production use. fr fr, don't skip this step. 🚨

🧚 SOURCE 🧚

this tool originated from BCC:

https://github.com/iovisor/bcc

the BCC version has many command line options for customizing the output. she's got range.

this bpftrace version originated from the book "BPF Performance Tools", published by Addison Wesley (2019):

http://www.brendangregg.com/bpf-performance-tools-book.html

see the book for more documentation on this tool. it's a whole read, highly recommend 📖

this bpftrace version is in the bpftrace repository:

https://github.com/bpftrace/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. iykyk 🎀

👑 OS 👑

Linux. obviously. 🐧

🫶 STABILITY 🫶

Unstable — in development.

she's still growing, okay?? we love a work in progress 🌱

💜 AUTHOR 💜

Brendan Gregg

the legend himself. we stan. 💅✨

🌸 SEE ALSO 🌸

and that's the whole page, bestie 🦋💖

cute sign-off: this page came from USER COMMANDS, dated 2019-07-03, and it's filed under the name tcplife.bt(8) — go forth and trace those lifespans, you've got this 🎀✨👑
📦 where this page comes from