tcpretrans(8)

💖 tcpretrans(8) ✨ System Manager's Manual 💖

🌸 NAME 🌸

okay so tcpretrans is the tool that traces or counts TCP retransmits and TLPs (tail loss probes) 🦋. It runs on Linux and uses eBPF/bcc, so it's giving low-level energy 💅.

🧚 SYNOPSIS 🧚

tcpretrans [-h] [-s] [-l] [-c] [-4 | -6]

💜 DESCRIPTION 💜

bestie, this one traces TCP retransmits and shows the address, port, and TCP state info for each one 🫶. Sometimes you'll also get the PID, but honestly usually not, because retransmits are usually sent by the kernel on timeouts 🙈. To keep the overhead super low, only the TCP retransmit functions get traced. It does not trace every packet, so it's not giving tcpdump(8) or a packet sniffer vibes ❌. If you want, it can also count retransmits over an interval you set yourself, which is a lowkey great way to spot network paths the flows go through that might be dropping stuff 🔥.

This works by dynamically tracing the kernel's tcp_retransmit_skb() and tcp_send_loss_probe() functions. Those can change with kernel updates, so the tool will need updating to match 🛠️.

⚠️ Since this uses BPF, only the root user can run this tool. No cap, that's a hard rule 💀.

🎀 REQUIREMENTS 🎀

You need CONFIG_BPF and bcc. That's the whole list, no notes 💅.

✨ OPTIONS ✨

• -h — Prints the usage message 💌.
• -s — Shows the TCP sequence numbers 🔢.
• -l — Includes tail loss probe attempts 🌈. Heads up, the kernel may not always finish the TLP send, so those can be incomplete.
• -c — Counts the retransmits that happen per flow 📊.
• -4 — Only traces the IPv4 family 🌸.
• -6 — Only traces the IPv6 family 🦋.

🍓 EXAMPLES 🍓

Trace TCP retransmits:

# tcpretrans

Trace TCP retransmits and TLP attempts:

# tcpretrans -l

Trace IPv4 family only:

# tcpretrans -4

Trace IPv6 family only:

# tcpretrans -6

📚 FIELDS 📚

• TIME — When the retransmit happened ⏰.
• PID — The process ID that was on-CPU 🧠. Less useful than it sounds, since it's often 0 (the kernel) for timer-based retransmits.
• IP — The IP address family, either 4 or 6 🌐.
• LADDR — The local IP address 🏠.
• LPORT — The local port 🚪.
• T> — The type of event: R> means retransmit, L> means tail loss probe 🎯.
• RADDR — The remote IP address 🛰️.
• RPORT — The remote port 🔌.
• STATE — The TCP session state 🫧.
• SEQ — The TCP sequence 🔢.
• RETRANSMITS — The total retransmits that have piled up since the start 📈.

🦋 OVERHEAD 🦋

The overhead should be negligible. TCP retransmit events are usually low (under 1000 per second), and the tiny bit of extra work this tool adds to each event keeps the cost basically nothing 💖.

🌈 SOURCE 🌈

This comes from bcc 🫶. Check out https://github.com/iovisor/bcc.

Also, look in the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool 📝.

🌍 OS 🌍

Linux 🐧

🧪 STABILITY 🧪

Unstable, still in development 🚧. Use it with a little caution, bestie.

👑 AUTHOR 👑

Brendan Gregg 🙌

🔗 SEE ALSO 🔗

tcpconnect(8), tcpaccept(8) 💜

---

Okay that's the whole tea 🫖 This page came from the USER COMMANDS manual, last updated 2016-02-14, and the manual name is tcpretrans(8). Go make the kernel behave, bestie 💅🎀✨