tcpsynbl.bt(8)

📦
version 0.27.0 · 3 versions
  • 0.27.0 · alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 0.14.0 · ubuntu jammy
  • 0.20.2 · ubuntu noble
, in alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ tcpsynbl.bt(8) — the TCP SYN backlog histogram ✨

okay bestie, welcome to tcpsynbl.bt 💖 this is a manual-page tool for showing the TCP SYN backlog as a histogram. it uses bpftrace/eBPF, so it's giving low-level and very, very cool 🧚

🌸 NAME

tcpsynbl.bt — Show the TCP SYN backlog as a histogram. Uses bpftrace/eBPF.

🎀 SYNOPSIS

tcpsynbl

💅 DESCRIPTION

okay so this tool shows the TCP SYN backlog size during SYN arrival as a histogram 📊 it lets you see how close your applications are to hitting the backlog limit and dropping SYNs 😭 which causes performance issues with SYN retransmits. it's basically a measure of workload saturation, so it's a huge vibe check for your servers 🔥 the histogram is measured at the time of SYN received, and there's a separate histogram for each backlog limit ✨

this works by tracing the tcp_v4_syn_recv_sock() and tcp_v6_syn_recv_sock() kernel functions using dynamic instrumentation 🦋 but ngl, these functions may change in future kernels, so this tool may need maintenance to keep working 💀

since this uses BPF, only the root user can use this tool. no cap, that's a hard rule 🔐

🫶 REQUIREMENTS

CONFIG_BPF and bpftrace. that's the whole list, bestie 🌈

🍓 EXAMPLES

show the TCP SYN backlog as a histogram.

# tcpsynbl.bt

🧚 FIELDS

  • backlog — the backlog size when a SYN was received.
  • count — the number of times this backlog size was encountered.
  • distribution — an ASCII visualization of the count column. iykyk 📈

🌙 OVERHEAD

inbound SYNs should be relatively low compared to packets and other events, so the overhead of this tool is expected to be negligible 💜

💖 SOURCE

this tool originated from the book "BPF Performance Tools", published by Addison Wesley (2019) 📚

http://www.brendangregg.com/bpf-performance-tools-book.html

see the book for more documentation on this tool, obviously 🙈

this version is in the bpftrace repository:

https://github.com/bpftrace/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool 🎀

🌈 OS

Linux 🐧

⭐ STABILITY

Unstable - in development. still cooking, so be gentle 🫠

👑 AUTHOR

Brendan Gregg 💅

🦋 SEE ALSO

tcptop(8)

tcpsynbl.bt(8) was sourced from the USER COMMANDS section of the 2019-07-03 page, so go forth and histogram responsibly, bestie 💖✨

📦 where this page comes from