DOKK / manpages / debian 12 / bpfcc-tools / tcpcong-bpfcc.8.en
tcpcong(8) System Manager's Manual tcpcong(8)

tcpcong - Measure tcp congestion state duration. Uses Linux eBPF/bcc.

tcpcong [-h] [-T] [-L] [-R] [-u] [-d] [interval] [outputs]

this tool measures tcp sockets congestion control status duration, and prints a summary of tcp congestion state durations along with the number of total state changes.

It uses dynamic tracing of kernel tcp congestion control status updating functions, and will need to be updated to match kernel changes.

The traced functions are only called when there is congestion state update, and therefore have low overhead. we also use BPF map to store traced data to reduce overhead. See the OVERHEAD section for more details. Since this uses BPF, only the root user can use this tool.

CONFIG_BPF and bcc.

Print usage message.
Include a timestamp column.
Specify local tcp port range.
Specify remote tcp port range.
Output in microseconds.
Show congestion status duration distribution as histograms.

# tcpcongestdura
# tcpcong 1 10
# tcpcong -L 3000-3006 1
# tcpcong -R 5000-5005 1
# tcpcong -uT 1
# tcpcong -d

local ip address and tcp socket port.
remote ip address and tcp socket port.
Total duration in open status for microseconds.
Total duration in disorder status for microseconds.
Total duration in recovery status for microseconds.
Total duration in cwr status for microseconds.
Total duration in loss status for microseconds.
Total duration in open status for milliseconds.
Total duration in disorder status for milliseconds.
Total duration in recovery status for milliseconds.
Total duration in cwr status for milliseconds.
Total duration in loss status for milliseconds.
Total number of status change.
Range of microseconds for this bucket.
Range of milliseconds for this bucket.
Number of congestion status in this time range.
ASCII representation of the distribution (the count column).

This traces the kernel tcp congestion status change functions. As called rate per second of these functions per socket is low(<10000), the overhead is also expected to be negligible. If you have an application that will create thousands of tcp connections, then test and understand overhead before use.

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool.

Linux

Unstable - in development.

jacky gan

tcpretrans(8), tcpconnect(8), tcptop(8), tcpdrop(8)

2022-01-27 USER COMMANDS