tcplife.bt - Trace TCP session lifespans with connection details. Uses bpftrace/eBPF.

       Brendan Gregg

       This  tool  shows  the lifespan of TCP sessions that open and close while tracing, and shows the duration
       and throughput statistics. For efficiency, this tool only instruments TCP state changes, rather than  all
       packets.

       This tool works by using the sock:inet_sock_set_state tracepoint, which was added in Linux 4.16.

       Since this uses BPF, only the root user can use this tool.

       Show TCP sessions with details:
              # tcplife.bt

       PID    Process ID

       COMM   Process name

       LADDR  Local IP address.

       DADDR  Remote IP address.

       LPORT  Local port.

       RPORT  Remote port.

       TX_KB  Total transmitted Kbytes.

       RX_KB  Total received Kbytes.

       MS     Lifespan of the session, in milliseconds.

       tcplife.bt - Trace TCP session lifespans with connection details. Uses bpftrace/eBPF.

       Linux

       This  traces  the kernel TCP set state function, which should be called much less often than send/receive
       tracing, and therefore have lower overhead. The overhead of the tool is relative to the rate of  new  TCP
       sessions:  if  this  is high, over 10,000 per second, then there may be noticeable overhead just to print
       out 10k lines of formatted output per second.

       You can find out the rate of new TCP sessions using "sar -n TCP 1", and adding the active/s and passive/s
       columns.

       As always, test and understand this tools overhead for your types of workloads before production use.

       CONFIG_BPF, bpftrace, and the sock:inet_sock_set_state tracepoint (Linux 4.16+).

tcptop(8)

USER COMMANDS                                      2019-07-03                                      tcplife.bt(8)

       This tool originated from BCC:

              https://github.com/iovisor/bcc

       The BCC version has many command line options for customizing the output.

       This bpftrace version originated from the book "BPF  Performance  Tools",  published  by  Addison  Wesley
       (2019):

              http://www.brendangregg.com/bpf-performance-tools-book.html

       See the book for more documentation on this tool.

       This bpftrace version is in the bpftrace repository:

              https://github.com/bpftrace/bpftrace

       Also  look  in  the  bpftrace  distribution  for a companion _examples.txt file containing example usage,
       output, and commentary for this tool.

       Unstable - in development.

tcplife