• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1Demonstrations of tcpstates, the Linux BPF/bcc version.
2
3
4tcpstates prints TCP state change information, including the duration in each
5state as milliseconds. For example, a single TCP session:
6
7# tcpstates
8SKADDR           C-PID C-COMM     LADDR           LPORT RADDR           RPORT OLDSTATE    -> NEWSTATE    MS
9ffff9fd7e8192000 22384 curl       100.66.100.185  0     52.33.159.26    80    CLOSE       -> SYN_SENT    0.000
10ffff9fd7e8192000 0     swapper/5  100.66.100.185  63446 52.33.159.26    80    SYN_SENT    -> ESTABLISHED 1.373
11ffff9fd7e8192000 22384 curl       100.66.100.185  63446 52.33.159.26    80    ESTABLISHED -> FIN_WAIT1   176.042
12ffff9fd7e8192000 0     swapper/5  100.66.100.185  63446 52.33.159.26    80    FIN_WAIT1   -> FIN_WAIT2   0.536
13ffff9fd7e8192000 0     swapper/5  100.66.100.185  63446 52.33.159.26    80    FIN_WAIT2   -> CLOSE       0.006
14^C
15
16This showed that the most time was spent in the ESTABLISHED state (which then
17transitioned to FIN_WAIT1), which was 176.042 milliseconds.
18
19The first column is the socked address, as the output may include lines from
20different sessions interleaved. The next two columns show the current on-CPU
21process ID and command name: these may show the process that owns the TCP
22session, depending on whether the state change executes synchronously in
23process context. If that's not the case, they may show kernel details.
24
25
26USAGE:
27
28# tcpstates -h
29usage: tcpstates [-h] [-T] [-t] [-w] [-s] [-L LOCALPORT] [-D REMOTEPORT]
30
31Trace TCP session state changes and durations
32
33optional arguments:
34  -h, --help            show this help message and exit
35  -T, --time            include time column on output (HH:MM:SS)
36  -t, --timestamp       include timestamp on output (seconds)
37  -w, --wide            wide column output (fits IPv6 addresses)
38  -s, --csv             comma separated values output
39  -L LOCALPORT, --localport LOCALPORT
40                        comma-separated list of local ports to trace.
41  -D REMOTEPORT, --remoteport REMOTEPORT
42                        comma-separated list of remote ports to trace.
43
44examples:
45    ./tcpstates           # trace all TCP state changes
46    ./tcpstates -t        # include timestamp column
47    ./tcpstates -T        # include time column (HH:MM:SS)
48    ./tcpstates -w        # wider colums (fit IPv6)
49    ./tcpstates -stT      # csv output, with times & timestamps
50    ./tcpstates -L 80     # only trace local port 80
51    ./tcpstates -L 80,81  # only trace local ports 80 and 81
52    ./tcpstates -D 80     # only trace remote port 80
53