tcpconnlat(8) System Manager's Manual tcpconnlat(8)
NAME
tcpconnlat - Trace TCP active connection latency. Uses Linux eBPF/bcc.
SYNOPSIS
tcpconnlat [-h] [-t] [-p PID] [-L] [-4 | -6] [-v] [min_ms]
DESCRIPTION
This tool traces active TCP connections (eg, via a connect() syscall),
and shows the latency (time) for the connection as measured locally:
the time from SYN sent to the response packet. This is a useful per-
formance metric that typically spans kernel TCP/IP processing and the
network round trip time (not application runtime).
All connection attempts are traced, even if they ultimately fail (RST
packet in response).
This tool works by use of kernel dynamic tracing of TCP/IP functions,
and will need updating to match any changes to these functions. This
tool should be updated in the future to use static tracepoints, once
they are available.
Since this uses BPF, only the root user can use this tool.
REQUIREMENTS
CONFIG_BPF and bcc.
OPTIONS
-h Print usage message.
-t Include a timestamp column.
-p PID Trace this process ID only (filtered in-kernel).
-L Include a LPORT column.
-4 Trace IPv4 family only.
-6 Trace IPv6 family only.
-v Print the resulting BPF program, for debugging purposes.
min_ms Minimum duration to trace, in milliseconds.
EXAMPLES
Trace all active TCP connections, and show connection latency (SYN->re-
sponse round trip):
# tcpconnlat
Include timestamps:
# tcpconnlat -t
Trace PID 181 only:
# tcpconnlat -p 181
Trace connects, and include LPORT:
# tcpconnlat -L
Trace IPv4 family only:
# tcpconnlat -4
Trace IPv6 family only:
# tcpconnlat -6
Trace connects with latency longer than 10 ms:
# tcpconnlat 10
Print the BPF program:
# tcpconnlat -v
FIELDS
TIME(s)
Time of the response packet, in seconds.
PID Process ID that initiated the connection.
COMM Process name that initiated the connection.
IP IP address family (4 or 6).
SADDR Source IP address.
DADDR Destination IP address.
LPORT Source port
DPORT Destination port
LAT(ms)
The time from when a TCP connect was issued (measured in-kernel)
to when a response packet was received for this connection (can
be SYN,ACK, or RST, etc). This time spans kernel to kernel la-
tency, involving kernel TCP/IP processing and the network round
trip in between. This typically does not include time spent by
the application processing the new connection.
OVERHEAD
This traces the kernel tcp_v[46]_connect functions and prints output
for each event. As the rate of this is generally expected to be low (<
1000/s), the overhead is also expected to be negligible. If you have an
application that is calling a high rate of connects()s, such as a proxy
server, then test and understand this overhead before use.
SOURCE
This is from bcc.
https://github.com/iovisor/bcc
Also look in the bcc distribution for a companion _examples.txt file
containing example usage, output, and commentary for this tool.
OS
Linux
STABILITY
Unstable - in development.
AUTHOR
Brendan Gregg
SEE ALSO
tcpconnect(8), tcpaccept(8), funccount(8), tcpdump(8)
USER COMMANDS 2016-02-19 tcpconnlat(8)
Generated by dwww version 1.16 on Tue Dec 16 05:45:59 CET 2025.