tcpaccept.bt(8) System Manager's Manual tcpaccept.bt(8)
NAME
tcpaccept.bt - Trace TCP passive connections (accept()). Uses bpf-
trace/eBPF
SYNOPSIS
tcpaccept.bt
DESCRIPTION
This tool traces passive TCP connections (eg, via an accept() syscall;
connect() are active connections). This can be useful for general trou-
bleshooting to see what new connections the local server is accepting.
This uses dynamic tracing of the kernel inet_csk_accept() socket func-
tion (from tcp_prot.accept), and will need to be modified to match ker-
nel changes.
This tool only traces successful TCP accept()s. Connection attempts to
closed ports will not be shown (those can be traced via other func-
tions).
Since this uses BPF, only the root user can use this tool.
REQUIREMENTS
CONFIG_BPF and bpftrace.
EXAMPLES
Trace all passive TCP connections (accept()s):
# tcpaccept.bt
FIELDS
TIME(s)
Time of the call, in HH:MM:SS format.
PID Process ID
COMM Process name
RADDR Remote IP address.
RPORT Remote port.
LADDR Local IP address.
LPORT Local port
BL Current accept backlog vs maximum backlog
OVERHEAD
This traces the kernel inet_csk_accept function and prints output for
each event. The rate of this depends on your server application. If it
is a web or proxy server accepting many tens of thousands of connec-
tions per second, then the overhead of this tool may be measurable (al-
though, still a lot better than tracing every packet). If it is less
than a thousand a second, then the overhead is expected to be negligi-
ble. Test and understand this overhead before use.
SOURCE
This is from bpftrace
https://github.com/iovisor/bpftrace
Also look in the bpftrace distribution for a companion _examples.txt
file containing example usage, output, and commentary for this tool.
This is a bpftrace version of the bcc tool of the same name. The bcc
tool may provide more options and customizations.
https://github.com/iovisor/bcc
OS
Linux
STABILITY
Unstable - in development.
AUTHOR
Brendan Gregg, adapted for bpftrace by Dale Hamel
SEE ALSO
tcpconnect.bt(8), funccount(8), tcpdump(8)
USER COMMANDS 2018-10-24 tcpaccept.bt(8)
Generated by dwww version 1.16 on Tue Dec 16 15:35:16 CET 2025.