tcpretrans.bt(8)

📦 version 0.17.0, in debian bookworm

💅 tcpretrans.bt — from the System Manager's Manual

okay bestie, gather round, because this one is literally a bop 💖 It's tcpretrans.bt, and it's your girl for tracing (or counting!) TCP retransmits. Uses Linux bpftrace/eBPF, no cap. ✨

🌸 SYNOPSIS 🌸

tcpretrans.bt

That's it. That's the whole thing. She's low maintenance. 🎀

✨ DESCRIPTION ✨

So what does she actually do? She traces TCP retransmits, and shows you the address, the port, and the TCP state info — and sometimes the PID. Not usually though, because retransmits are normally sent by the kernel on timeouts, so don't get your hopes up on the PID front. 🙈

The way she keeps overhead so low is that she only traces the TCP retransmit functions. She does not trace every single packet like tcpdump(8) or a packet sniffer would. She's not doing all that. 👑

And optionally? She can count retransmits over a user signalled interval, which is genuinely so useful for spotting potentially dropping network paths that your flows are traversing. iykyk. 🔥

Under the hood she's doing dynamic tracing of the kernel's tcp_retransmit_skb() and tcp_send_loss_probe() functions — which means she'll need to be updated to match any kernel changes to those functions. Keep that in mind, bestie. 🦋

Since this uses BPF, only the root user can use this tool. Root only, no exceptions, periodt. 💅

🧚 REQUIREMENTS 🧚

  • CONFIG_BPF and bcc.
  • CONFIG_BPF and bpftrace.

Both. You need both. That's the vibe check. ⭐

🌈 EXAMPLES 🌈

Trace TCP retransmits:

# tcpretrans.bt

🍓 FIELDS 🍓

Here's the tea on every column you'll see:

  • TIME — Time of the call, in HH:MM:SS format. 🕐
  • PID — Process ID that was on-CPU. And ngl, this is less useful than it might sound, because it may usually be 0, for the kernel, for timer-based retransmits. So like... don't build your whole theory around it. 😭
  • LADDR — Local IP address.
  • LPORT — Local port.
  • RADDR — Remote IP address.
  • RPORT — Remote port.
  • STATE — TCP session state. 👑

💜 OVERHEAD 💜

Should be negligible, fr fr. TCP retransmit events should be low (under <1000/s), and the low overhead this tool adds to each event should make the cost negligible. She's light on her feet, she's not gonna tank your system. 🫶

🌸 SOURCE 🌸

This is from bpftrace:

https://github.com/iovisor/bpftrace

Also — go look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. It's giving bonus content. ✨

And fyi, this is a bpftrace version of the bcc tool of the same name. The bcc tool may provide more options and customizations, so if you want more knobs to turn:

https://github.com/iovisor/bcc

🦋 OS 🦋

Linux. Obviously. 💀

🎀 STABILITY 🎀

Unstable — in development. She's still growing, okay?? Be nice to her. 🙈

👑 AUTHOR 👑

Brendan Gregg, adapted for bpftrace by Dale Hamel. Legends only. 💅

⭐ SEE ALSO ⭐

okay that's the whole page bestie, you ate that 💖 this was a USER COMMANDS page, dated 2018-11-24 — go forth and trace those retransmits, mwah! 🎀✨

📦 where this page comes from