Brendan Gregg | afc9725 | 2016-02-19 16:07:36 -0800 | [diff] [blame] | 1 | Demonstrations of tcpconnlat, the Linux eBPF/bcc version. |
| 2 | |
| 3 | |
| 4 | This tool traces the kernel function performing active TCP connections |
| 5 | (eg, via a connect() syscall), and shows the latency (time) for the connection |
| 6 | as measured locally: the time from SYN sent to the response packet. |
| 7 | For example: |
| 8 | |
| 9 | # ./tcpconnlat |
| 10 | PID COMM IP SADDR DADDR DPORT LAT(ms) |
| 11 | 1201 wget 4 10.153.223.157 23.23.100.231 80 1.65 |
| 12 | 1201 wget 4 10.153.223.157 23.23.100.231 443 1.60 |
| 13 | 1433 curl 4 10.153.223.157 104.20.25.153 80 0.75 |
| 14 | 1690 wget 4 10.153.223.157 66.220.156.68 80 1.10 |
| 15 | 1690 wget 4 10.153.223.157 66.220.156.68 443 0.95 |
| 16 | 1690 wget 4 10.153.223.157 66.220.156.68 443 0.99 |
| 17 | 2852 curl 4 10.153.223.157 23.101.17.61 80 250.86 |
Mark Drayton | 11de298 | 2016-06-26 21:14:44 +0100 | [diff] [blame] | 18 | 20337 python2.7 6 1234:ab12:2040:5020:2299:0:5:0 1234:ab12:20:9f1d:2299:dde9:0:f5 7001 62.20 |
| 19 | 21588 nc 6 ::1 ::1 80 0.05 |
Brendan Gregg | afc9725 | 2016-02-19 16:07:36 -0800 | [diff] [blame] | 20 | [...] |
| 21 | |
| 22 | The first line shows a connection from the "wget" process to the IPv4 |
| 23 | destination address 23.23.100.231, port 80. This took 1.65 milliseconds: the |
| 24 | time from the SYN to the response. |
| 25 | |
| 26 | TCP connection latency is a useful performance measure showing the time taken |
| 27 | to establish a connection. This typically involves kernel TCP/IP processing |
| 28 | and the network round trip time, and not application runtime. |
| 29 | |
| 30 | tcpconnlat measures the time from any connection to the response packet, even |
| 31 | if the response is a RST (port closed). |
| 32 | |
| 33 | |
| 34 | USAGE message: |
| 35 | |
| 36 | # ./tcpconnlat -h |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 37 | usage: tcpconnlat [-h] [-t] [-p PID] [-L] [-4 | -6] [-v] [duration_ms] |
Brendan Gregg | afc9725 | 2016-02-19 16:07:36 -0800 | [diff] [blame] | 38 | |
| 39 | Trace TCP connects and show connection latency |
| 40 | |
dpayne | 40cf3a3 | 2018-01-19 09:07:17 -0800 | [diff] [blame] | 41 | positional arguments: |
suresh kumar | 456cb95 | 2021-03-15 09:03:37 +0530 | [diff] [blame] | 42 | duration_ms minimum duration to trace (ms) |
dpayne | 40cf3a3 | 2018-01-19 09:07:17 -0800 | [diff] [blame] | 43 | |
Brendan Gregg | afc9725 | 2016-02-19 16:07:36 -0800 | [diff] [blame] | 44 | optional arguments: |
| 45 | -h, --help show this help message and exit |
| 46 | -t, --timestamp include timestamp on output |
| 47 | -p PID, --pid PID trace this PID only |
suresh kumar | 456cb95 | 2021-03-15 09:03:37 +0530 | [diff] [blame] | 48 | -L, --lport include LPORT on output |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 49 | -4, --ipv4 trace IPv4 family only |
| 50 | -6 --ipv6 trace IPv6 family only |
suresh kumar | 456cb95 | 2021-03-15 09:03:37 +0530 | [diff] [blame] | 51 | -v, --verbose print the BPF program for debugging purposes |
Brendan Gregg | afc9725 | 2016-02-19 16:07:36 -0800 | [diff] [blame] | 52 | |
| 53 | examples: |
| 54 | ./tcpconnlat # trace all TCP connect()s |
suresh kumar | 456cb95 | 2021-03-15 09:03:37 +0530 | [diff] [blame] | 55 | ./tcpconnlat 1 # trace connection latency slower than 1 ms |
| 56 | ./tcpconnlat 0.1 # trace connection latency slower than 100 us |
Brendan Gregg | afc9725 | 2016-02-19 16:07:36 -0800 | [diff] [blame] | 57 | ./tcpconnlat -t # include timestamps |
| 58 | ./tcpconnlat -p 181 # only trace PID 181 |
suresh kumar | 456cb95 | 2021-03-15 09:03:37 +0530 | [diff] [blame] | 59 | ./tcpconnlat -L # include LPORT while printing outputs |
Hariharan Ananthakrishnan | 04893e3 | 2021-08-12 05:55:21 -0700 | [diff] [blame] | 60 | ./tcpconnlat -4 # trace IPv4 family only |
| 61 | ./tcpconnlat -6 # trace IPv6 family only |