Manual: tcpdrop-bpfcc

tcpdrop(8)					   System Manager's Manual					  tcpdrop(8)

NAME
       tcpdrop - Trace kernel-based TCP packet drops with details. Uses Linux eBPF/bcc.

SYNOPSIS
       tcpdrop [-4 | -6] [-h]

DESCRIPTION
       This tool traces TCP packets or segments that were dropped by the kernel, and shows details from the IP and TCP head‐
       ers, the socket state, and the kernel stack trace. This is useful for debugging cases of high kernel drops, which can
       cause timer-based retransmits and performance issues.

       This tool works using dynamic tracing of the tcp_drop() kernel function, which requires a recent kernel version.

       Since this uses BPF, only the root user can use this tool.

REQUIREMENTS
       CONFIG_BPF and bcc.

OPTIONS
       -4     Trace IPv4 family only.

       -6     Trace IPv6 family only.

       -h     Print usage message.

EXAMPLES
       Trace kernel-based TCP packet drops with details:
	      # tcpdrop

       Trace IPv4 family only:
	      # tcpdrop -4

       Trace IPv6 family only:
	      # tcpdrop -6

FIELDS
       TIME   Time of the drop, in HH:MM:SS format.

       PID    Process ID that was on-CPU during the drop. This may be unrelated, as drops can occur on the receive interrupt
	      and be unrelated to the PID that was interrupted.

       IP     IP address family (4 or 6)

       SADDR  Source IP address.

       SPORT  Source TCP port.

       DADDR  Destination IP address.

       DPORT  Destionation TCP port.

       STATE  TCP session state ("ESTABLISHED", etc).

       FLAGS  TCP flags ("SYN", etc).

OVERHEAD
       This  traces  the  kernel tcp_drop() function, which should be low frequency, and therefore the overhead of this tool
       should be negligible.

       As always, test and understand this tools overhead for your types of workloads before production use.

SOURCE
       This is from bcc.

	      https://github.com/iovisor/bcc

       Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary
       for this tool.

OS
       Linux

STABILITY
       Unstable - in development.

AUTHOR
       Brendan Gregg

SEE ALSO
       tcplife(8), tcpaccept(8), tcpconnect(8), tcptop(8)

USER COMMANDS						 2018-05-30						  tcpdrop(8)