tcpsynbl.bt(8)

📦 version 0.17.0, in debian bookworm

💅 tcpsynbl.bt — bestie's guide to the SYN backlog 💅

okay so real quick: this is a page from section 8 of the System Manager's Manual, and the star of the show is tcpsynbl.bt. she's a bpftrace/eBPF girlie. let's get into it 🫶

✨ NAME ✨

tcpsynbl.bt — shows the TCP SYN backlog as a histogram. it uses bpftrace/eBPF, no cap 💖

🌸 SYNOPSIS 🌸

tcpsynbl

🦋 DESCRIPTION 🦋

okay so picture this: this tool shows you the TCP SYN backlog size right when a SYN arrives, and it draws it as a histogram. why do you care?? because it literally lets you see how close your apps are to hitting the backlog limit and just. dropping SYNs. 😭 and dropped SYNs mean SYN retransmits, which means performance issues, which means everyone's sad. it's also a measure of workload saturation, iykyk.

the histogram you see is measured at the time of SYN received, and there's a separate histogram shown for each backlog limit. one per limit, she's thorough 💅

how does she do it? she traces the tcp_v4_syn_recv_sock() and tcp_v6_syn_recv_sock() kernel functions using dynamic instrumentation. and like... since these functions may change in future kernels, this tool may need maintenance to keep working. so if she breaks on a new kernel, that's why, bestie. not her fault fr fr.

also since this uses BPF, only the root user can use this tool. root only. periodt. 👑

🎀 REQUIREMENTS 🎀

  • CONFIG_BPF
  • bpftrace

that's the whole list. iconic, low maintenance ✨

🔥 EXAMPLES 🔥

show the TCP SYN backlog as a histogram:

# tcpsynbl.bt

that's it, that's the example. go off 💜

🌈 FIELDS 🌈

  • backlog — the backlog size when a SYN was received.
  • count — the number of times this backlog size was encountered.
  • distribution — an ASCII visualization of the count column. yes bestie, she draws you a little picture 📊

⭐ OVERHEAD ⭐

inbound SYNs should be relatively low compared to packets and other events, so the overhead of this tool is expected to be negligible. tiny. micro. basically nothing. obsessed. 🧚

💖 SOURCE 💖

this tool originated from the book "BPF Performance Tools", published by Addison Wesley (2019):

http://www.brendangregg.com/bpf-performance-tools-book.html

see the book for more documentation on this tool 📚

this version is in the bpftrace repository:

https://github.com/iovisor/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. it's giving bonus content 🍓

🐧 OS 🐧

Linux

💀 STABILITY 💀

Unstable — in development.

she's in her WIP era, okay?? handle with care 🙈

👑 AUTHOR 👑

Brendan Gregg

🌟 SEE ALSO 🌟

tcptop(8)

and that's the whole page, bestie!! this was the USER COMMANDS version, dated 2019-07-03, and the manual page you're holding is tcpsynbl.bt(8). go forth and check your backlog before it checks you 💖✨🎀

📦 where this page comes from