tcpsubnet(8)

✨ tcpsubnet ✨

tcpsubnet is a manual page for a tool that summarizes and aggregates IPv4 TCP traffic by subnet 💖

📍 NAME

okay so tcpsubnet is the tool that summarizes and aggregates IPv4 TCP traffic by subnet 🦋

🧾 SYNOPSIS

tcpsubnet [-h] [-v] [-J] [-f FORMAT] [-i INTERVAL] [subnets]

💭 DESCRIPTION

bestie, this tool summarizes and aggregates IPv4 TCP sent to the subnets you pass in as an argument, then prints to stdout on a fixed interval ✨

It uses dynamic tracing of kernel TCP send/receive functions, so it's giving "kernel-aware" energy, but it will need updating whenever the kernel changes 🔥

The traced data gets summarized in-kernel with a BPF map to keep overhead low 💅. Still, at very high TCP event rates, the overhead may be measurable. Check the OVERHEAD section for the tea ☕

Since this uses BPF, only the root user can use this tool. No root, no tcpsubnet 🙈

🛠️ REQUIREMENTS

You'll need CONFIG_BPF and bcc 🧚

🎀 OPTIONS

• -h — Prints the USAGE message 🌸
• -v — Runs in verbose mode. It outputs the subnet evaluation and the BPF program 🔍
• -J — Formats the output as JSON 💜
• -i — Sets the interval between updates, in seconds. The default is 1 ⏰
• -f — Formats the output units. Supported values are bkmBKM. When you use kmKM, the output gets rounded to floor 🍓
• subnets — A comma separated list of subnets. Traffic gets sorted into these subnets, and order matters 👑 The default is 127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,0.0.0.0/0

🌈 EXAMPLES

Summarize TCP traffic by the default subnets:

# tcpsubnet

Summarize all TCP traffic:

# tcpsubnet 0.0.0.0/0

Summarize all TCP traffic and output in JSON and Kb:

# tcpsubnet -J -fk 0.0.0.0/0

🔎 FIELDS

Here's what you'll see in the output 👀

• Standard output, left hand column — Subnet
• Standard output, right hand column — Aggregate traffic in the units you passed as an argument
• JSON output, date — The current date, formatted in the system locale
• JSON output, time — The current time, formatted in the system locale
• JSON output, entries — A map of subnets to aggregates. Values are in the format you passed to -f

🐢 OVERHEAD

Okay this part is important, so listen up 🫶 This traces all tcp_sendmsg function calls in the TCP/IP stack, and it summarizes data in-kernel to keep the overhead down. In a simple iperf test (v2.0.5) with the default values, throughput dropped by about 5%. Over 10 runs without tcpsubnet running, the average throughput was 32.42Gb/s. With tcpsubnet enabled, it was 31.26Gb/s 📉

This is not meant to be used as a long running service. Use it for troubleshooting or for a controlled interval. As always, try it out in a test environment first 🙈

📦 SOURCE

This one's from bcc 💖

• https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool 📚

💻 OS

Linux 🐧

🧪 STABILITY

Unstable, still in development 🚧

👩‍💻 AUTHOR

Rodrigo Manyari 🌟

💡 INSPIRATION

tcptop(8) by Brendan Gregg 🦋

🔗 SEE ALSO

netlink(7) 🫶

---

Man page vibes check: this one's from the USER COMMANDS section and dated 2018-03-01. Stay iconic, stay root-approved, and go tcpsubnet your little heart out 💅✨🎀