tcpconnect - Trace TCP active connection latency. Uses Linux eBPF/bcc.
tcpconnect [-h] [-t] [-p PID]
This tool traces active TCP connections (eg, via a connect() syscall), and shows
the latency (time) for the connection as measured locally: the time from SYN
sent to the response packet. This is a useful performance metric that
typically spans kernel TCP/IP processing and the network round trip time (not
All connection attempts are traced, even if they ultimately fail (RST packet in
This tool works by use of kernel dynamic tracing of TCP/IP functions, and will
need updating to match any changes to these functions. This tool should be
updated in the future to use static tracepoints, once they are available.
Since this uses BPF, only the root user can use this tool.
CONFIG_BPF and bcc.
- Print usage message.
- Include a timestamp column.
- -p PID
- Trace this process ID only (filtered in-kernel).
- Trace all active TCP connections, and show connection
latency (SYN->response round trip):
- # tcpconnect
- Include timestamps:
- # tcpconnect -t
- Trace PID 181 only:
- # tcpconnect -p 181
- Time of the response packet, in seconds.
- Process ID that initiated the connection.
- Process name that initiated the connection.
- IP address family (4 or 6).
- Source IP address.
- Destination IP address.
- Destination port
- The time from when a TCP connect was issued (measured
in-kernel) to when a response packet was received for this connection (can
be SYN,ACK, or RST, etc). This time spans kernel to kernel latency,
involving kernel TCP/IP processing and the network round trip in between.
This typically does not include time spent by the application processing
the new connection.
This traces the kernel tcp_v_connect functions and prints output for each
event. As the rate of this is generally expected to be low (< 1000/s), the
overhead is also expected to be negligible. If you have an application that is
calling a high rate of connects()s, such as a proxy server, then test and
understand this overhead before use.
This is from bcc.
Also look in the bcc distribution for a companion _examples.txt file containing
example usage, output, and commentary for this tool.
Unstable - in development.
tcpconnect(8), tcpaccept(8), funccount(8), tcpdump(8)