tcptracer(8) System Manager's Manual tcptracer(8)
NAME
tcptracer - Trace TCP established connections. Uses Linux eBPF/bcc.
SYNOPSIS
tcptracer [-h] [-v] [-t] [-p PID] [-N NETNS] [--cgroupmap MAPPATH]
[--mntnsmap MAPPATH] [-4 | -6]
DESCRIPTION
This tool traces established TCP connections that open and close while
tracing, and prints a line of output per connect, accept and close
events. This includes the type of event, PID, IP addresses and ports.
This tool works by using kernel dynamic tracing, and will need to be
updated if the kernel implementation changes. Only established TCP con-
nections are traced, so it is expected that the overhead of this tool
is rather low.
Since this uses BPF, only the root user can use this tool.
REQUIREMENTS
CONFIG_BPF and bcc.
OPTIONS
-h Print usage message.
-v Print full lines, with long event type names and network name-
space numbers.
-t Include timestamp on output
-p PID Trace this process ID only (filtered in-kernel).
-N NETNS
Trace this network namespace only (filtered in-kernel).
--cgroupmap MAPPATH
Trace cgroups in this BPF map only (filtered in-kernel).
--mntnsmap MAPPATH
Trace mount namespaces in the map (filtered in-kernel).
-4 Trace IPv4 family only.
-6 Trace IPv6 family only.
EXAMPLES
Trace all TCP established connections:
# tcptracer
Trace all TCP established connections with verbose lines:
# tcptracer -v
Trace PID 181 only:
# tcptracer -p 181
Trace connections in network namespace 4026531969 only:
# tcptracer -N 4026531969
Trace a set of cgroups only (see special_filtering.md from bcc sources
for more details):
# tcptracer --cgroupmap /sys/fs/bpf/test01
Trace IPv4 family only:
# tcptracer -4
Trace IPv6 family only:
# tcptracer -6
FIELDS
TYPE Type of event. In non-verbose mode: C for connect, A for accept,
X for close.
PID Process ID
COMM Process name
IP IP address family (4 or 6)
SADDR Source IP address.
DADDR Destination IP address.
SPORT Source port.
DPORT Destination port.
NETNS Network namespace where the event originated.
OVERHEAD
This traces the kernel inet accept function, and the TCP connect,
close, and set state functions. However, it only prints information for
connections that are established, so it shouldn't have a huge overhead.
As always, test and understand this tools overhead for your types of
workloads before production use.
SOURCE
This is from bcc.
https://github.com/iovisor/bcc
Also look in the bcc distribution for a companion _examples.txt file
containing example usage, output, and commentary for this tool.
OS
Linux
STABILITY
Unstable - in development.
AUTHOR
Iago López Galeiras
SEE ALSO
tcpaccept(8), tcpconnect(8), tcptop(8), tcplife(8)
USER COMMANDS 2020-02-20 tcptracer(8)
Generated by dwww version 1.16 on Tue Dec 16 05:46:41 CET 2025.