tcptracer(8) | System Manager's Manual | tcptracer(8) |
tcptracer - Trace TCP established connections. Uses Linux eBPF/bcc.
tcptracer [-h] [-v] [-p PID] [-N NETNS]
This tool traces established TCP connections that open and close while tracing, and prints a line of output per connect, accept and close events. This includes the type of event, PID, IP addresses and ports.
This tool works by using kernel dynamic tracing, and will need to be updated if the kernel implementation changes. Only established TCP connections are traced, so it is expected that the overhead of this tool is rather low.
Since this uses BPF, only the root user can use this tool.
CONFIG_BPF and bcc.
This traces the kernel inet accept function, and the TCP connect, close, and set state functions. However, it only prints information for connections that are established, so it shouldn't have a huge overhead.
As always, test and understand this tools overhead for your types of workloads before production use.
This is from bcc.
Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool.
Linux
Unstable - in development.
Iago López Galeiras
2017-03-27 | USER COMMANDS |