tcpaccept man page

tcpaccept ā€” Trace TCP passive connections (accept()). Uses Linux eBPF/bcc.

Synopsis

tcpaccept [-h] [-t] [-x] [-p PID]

Description

This tool traces passive TCP connections (eg, via an accept() syscall; connect() are active connections). This can be useful for general troubleshooting to see what new connections the local server is accepting.

This uses dynamic tracing of the kernel inet_csk_accept() socket function (from tcp_prot.accept), and will need to be modified to match kernel changes.

This tool only traces successful TCP accept()s. Connection attempts to closed ports will not be shown (those can be traced via other functions).

Since this uses BPF, only the root user can use this tool.

Requirements

CONFIG_BPF and bcc.

Options

-h

Print usage message.

-t

Include a timestamp column.

-p PID

Trace this process ID only (filtered in-kernel).

Examples

Trace all passive TCP connections (accept()s):

# tcpaccept

Trace all TCP accepts, and include timestamps:

# tcpconnect -t

Trace PID 181 only:

# tcpconnect -p 181

Fields

TIME(s)

Time of the event, in seconds.

PID

Process ID

COMM

Process name

IP

IP address family (4 or 6)

RADDR

Remote IP address.

LADDR

Local IP address.

LPORT

Local port

Overhead

This traces the kernel inet_csk_accept function and prints output for each event. The rate of this depends on your server application. If it is a web or proxy server accepting many tens of thousands of connections per second, then the overhead of this tool may be measurable (although, still a lot better than tracing every packet). If it is less than a thousand a second, then the overhead is expected to be negligible. Test and understand this overhead before use.

Source

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool.

OS

Linux

Stability

Unstable - in development.

Author

Brendan Gregg

See Also

tcpconnect(8), funccount(8), tcpdump(8)

Referenced By

tcpconnect(8), tcpconnlat(8), tcplife(8), tcpretrans(8), tcptop(8), tcptracer(8).

2015-08-25 USER COMMANDS