blob: 63ba2efae67aa849c670612f8bccbb9c84fdc318 [file] [log] [blame]
Brendan Gregg60393ea2016-10-04 15:18:11 -07001Demonstrations of tcptop, the Linux eBPF/bcc version.
2
3
4tcptop summarizes throughput by host and port. Eg:
5
6# tcptop
7Tracing... Output every 1 secs. Hit Ctrl-C to end
8<screen clears>
919:46:24 loadavg: 1.86 2.67 2.91 3/362 16681
10
11PID COMM LADDR RADDR RX_KB TX_KB
1216648 16648 100.66.3.172:22 100.127.69.165:6684 1 0
1316647 sshd 100.66.3.172:22 100.127.69.165:6684 0 2149
1414374 sshd 100.66.3.172:22 100.127.69.165:25219 0 0
1514458 sshd 100.66.3.172:22 100.127.69.165:7165 0 0
16
17PID COMM LADDR6 RADDR6 RX_KB TX_KB
1816681 sshd fe80::8a3:9dff:fed5:6b19:22 fe80::8a3:9dff:fed5:6b19:16606 1 1
1916679 ssh fe80::8a3:9dff:fed5:6b19:16606 fe80::8a3:9dff:fed5:6b19:22 1 1
2016680 sshd fe80::8a3:9dff:fed5:6b19:22 fe80::8a3:9dff:fed5:6b19:16606 0 0
21
22This example output shows two listings of TCP connections, for IPv4 and IPv6.
23If there is only traffic for one of these, then only one group is shown.
24
25The output in each listing is sorted by total throughput (send then receive),
26and when printed it is rounded (floor) to the nearest Kbyte. The example output
27shows PID 16647, sshd, transmitted 2149 Kbytes during the tracing interval.
28The other IPv4 sessions had such low throughput they rounded to zero.
29
30All TCP sessions, including over loopback, are included.
31
32The session with the process name (COMM) of 16648 is really a short-lived
33process with PID 16648 where we didn't catch the process name when printing
34the output. If this behavior is a serious issue for you, you can modify the
35tool's code to include bpf_get_current_comm() in the key structs, so that it's
36fetched during the event and will always be seen. I did it this way to start
37with, but it was measurably increasing the overhead of this tool, so I switched
38to the asynchronous model.
39
40The overhead is relative to TCP event rate (the rate of tcp_sendmsg() and
41tcp_recvmsg() or tcp_cleanup_rbuf()). Due to buffering, this should be lower
42than the packet rate. You can measure the rate of these using funccount.
43Some sample production servers tested found total rates of 4k to 15k per
44second. The CPU overhead at these rates ranged from 0.5% to 2.0% of one CPU.
45Maybe your workloads have higher rates and therefore higher overhead, or,
46lower rates.
47
48
49I much prefer not clearing the screen, so that historic output is in the
50scroll-back buffer, and patterns or intermittent issues can be better seen.
51You can do this with -C:
52
53# tcptop -C
54Tracing... Output every 1 secs. Hit Ctrl-C to end
55
5620:27:12 loadavg: 0.08 0.02 0.17 2/367 17342
57
58PID COMM LADDR RADDR RX_KB TX_KB
5917287 17287 100.66.3.172:22 100.127.69.165:57585 3 1
6017286 sshd 100.66.3.172:22 100.127.69.165:57585 0 1
6114374 sshd 100.66.3.172:22 100.127.69.165:25219 0 0
62
6320:27:13 loadavg: 0.08 0.02 0.17 1/367 17342
64
65PID COMM LADDR RADDR RX_KB TX_KB
6617286 sshd 100.66.3.172:22 100.127.69.165:57585 1 7761
6714374 sshd 100.66.3.172:22 100.127.69.165:25219 0 0
68
6920:27:14 loadavg: 0.08 0.02 0.17 2/365 17347
70
71PID COMM LADDR RADDR RX_KB TX_KB
7217286 17286 100.66.3.172:22 100.127.69.165:57585 1 2501
7314374 sshd 100.66.3.172:22 100.127.69.165:25219 0 0
74
7520:27:15 loadavg: 0.07 0.02 0.17 2/367 17403
76
77PID COMM LADDR RADDR RX_KB TX_KB
7817349 17349 100.66.3.172:22 100.127.69.165:10161 3 1
7917348 sshd 100.66.3.172:22 100.127.69.165:10161 0 1
8014374 sshd 100.66.3.172:22 100.127.69.165:25219 0 0
81
8220:27:16 loadavg: 0.07 0.02 0.17 1/367 17403
83
84PID COMM LADDR RADDR RX_KB TX_KB
8517348 sshd 100.66.3.172:22 100.127.69.165:10161 3333 0
8614374 sshd 100.66.3.172:22 100.127.69.165:25219 0 0
87
8820:27:17 loadavg: 0.07 0.02 0.17 2/366 17409
89
90PID COMM LADDR RADDR RX_KB TX_KB
9117348 17348 100.66.3.172:22 100.127.69.165:10161 6909 2
92
93You can disable the loadavg summary line with -S if needed.
94
95
96USAGE:
97
98# tcptop -h
99usage: tcptop.py [-h] [-C] [-S] [-p PID] [interval] [count]
100
101Summarize TCP send/recv throughput by host
102
103positional arguments:
104 interval output interval, in seconds (default 1)
105 count number of outputs
106
107optional arguments:
108 -h, --help show this help message and exit
109 -C, --noclear don't clear the screen
110 -S, --nosummary skip system summary line
111 -p PID, --pid PID trace this PID only
112
113examples:
114 ./tcptop # trace TCP send/recv by host
115 ./tcptop -C # don't clear the screen
116 ./tcptop -p 181 # only trace PID 181