tcpsynbl(8)

🦋 NAME 🦋

okay bestie, meet tcpsynbl(8) 💖 it's a tool that shows the TCP SYN backlog as a histogram ✨ and it uses BCC/eBPF 🔥 so it's giving low-level main character energy.

💅 SYNOPSIS 💅

tcpsynbl [-4 | -6]

✨ DESCRIPTION ✨

okay so this tool shows you the TCP SYN backlog size at the moment a SYN arrives, and it shows it as a histogram 📊 the way that this helps you see how close your apps are to hitting the backlog limit 😭 and when that happens, SYNs get dropped, which causes performance issues with SYN retransmits. it's basically a measure of workload saturation 🫶 The histogram is measured at the time of SYN received, and you get a separate histogram for each backlog limit 🌈

this works by tracing the tcp_v4_syn_recv_sock() and tcp_v6_syn_recv_sock() kernel functions using dynamic instrumentation 🧚 but ngl, these functions might change in future kernels, so this tool may need maintenance to keep working ⚠️

also, since this uses BPF, only the root user can use this tool 👑 no cap.

🎀 REQUIREMENTS 🎀

you'll need CONFIG_BPF and BCC 💜

🌸 OPTIONS 🌸

• -h — print the usage message 💌
• -4 — trace the IPv4 family only 🍓
• -6 — trace the IPv6 family only 🌊

🍓 EXAMPLES 🍓

show the TCP SYN backlog as a histogram ✨

# tcpsynbl

trace the IPv4 family only:

# tcpsynbl -4

trace the IPv6 family only:

# tcpsynbl -6

📊 FIELDS 📊

• backlog — the backlog size when a SYN was received 🎯
• count — the number of times this backlog size was encountered 🔢
• distribution — an ASCII visualization of the count column 🎨

🫧 OVERHEAD 🫧

inbound SYNs should be relatively low compared to packets and other events, so the overhead of this tool is expected to be negligible 💅 lowkey the best kind of overhead.

📚 SOURCE 📚

this originated as a bpftrace tool from the book "BPF Performance Tools", published by Addison Wesley (2019) 📖 the book is here:

http://www.brendangregg.com/bpf-performance-tools-book.html

see the book for more documentation on this tool 🤓

this version lives in the BCC repository:

https://github.com/iovisor/bcc

also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool 🫶

🌈 OS 🌈

Linux 🐧

🧪 STABILITY 🧪

Unstable - in development. it's still cooking, so don't be shocked if things shift 🙈

👑 AUTHOR 👑

Brendan Gregg 💜

🔗 SEE ALSO 🔗

tcptop(8) 🦋

---

bestie, that's the whole page 💖 it's from the BCC-era manpages, the source/version line says USER COMMANDS and the date is 2019-07-03 🌸 and the manual is tcpsynbl(8) 🧚 slay forever ✨