tcpdrop(8) System Manager's Manual tcpdrop(8)
NAME
tcpdrop - Trace kernel-based TCP packet drops with details. Uses Linux
eBPF/bcc.
SYNOPSIS
tcpdrop [-4 | -6] [-h]
DESCRIPTION
This tool traces TCP packets or segments that were dropped by the ker-
nel, and shows details from the IP and TCP headers, the socket state,
and the kernel stack trace. This is useful for debugging cases of high
kernel drops, which can cause timer-based retransmits and performance
issues.
This tool works using dynamic tracing of the tcp_drop() kernel func-
tion, which requires a recent kernel version.
Since this uses BPF, only the root user can use this tool.
REQUIREMENTS
CONFIG_BPF and bcc.
OPTIONS
-4 Trace IPv4 family only.
-6 Trace IPv6 family only.
-h Print usage message.
EXAMPLES
Trace kernel-based TCP packet drops with details:
# tcpdrop
Trace IPv4 family only:
# tcpdrop -4
Trace IPv6 family only:
# tcpdrop -6
FIELDS
TIME Time of the drop, in HH:MM:SS format.
PID Process ID that was on-CPU during the drop. This may be unre-
lated, as drops can occur on the receive interrupt and be unre-
lated to the PID that was interrupted.
IP IP address family (4 or 6)
SADDR Source IP address.
SPORT Source TCP port.
DADDR Destination IP address.
DPORT Destionation TCP port.
STATE TCP session state ("ESTABLISHED", etc).
FLAGS TCP flags ("SYN", etc).
OVERHEAD
This traces the kernel tcp_drop() function, which should be low fre-
quency, and therefore the overhead of this tool should be negligible.
As always, test and understand this tools overhead for your types of
workloads before production use.
SOURCE
This is from bcc.
https://github.com/iovisor/bcc
Also look in the bcc distribution for a companion _examples.txt file
containing example usage, output, and commentary for this tool.
OS
Linux
STABILITY
Unstable - in development.
AUTHOR
Brendan Gregg
SEE ALSO
tcplife(8), tcpaccept(8), tcpconnect(8), tcptop(8)
USER COMMANDS 2018-05-30 tcpdrop(8)
Generated by dwww version 1.16 on Tue Dec 16 05:45:42 CET 2025.