1 Demonstrations of tcpconnlat, the Linux eBPF/bcc version. 2 3 4 This tool traces the kernel function performing active TCP connections 5 (eg, via a connect() syscall), and shows the latency (time) for the connection 6 as measured locally: the time from SYN sent to the response packet. 7 For example: 8 9 # ./tcpconnlat 10 PID COMM IP SADDR DADDR DPORT LAT(ms) 11 1201 wget 4 10.153.223.157 23.23.100.231 80 1.65 12 1201 wget 4 10.153.223.157 23.23.100.231 443 1.60 13 1433 curl 4 10.153.223.157 104.20.25.153 80 0.75 14 1690 wget 4 10.153.223.157 66.220.156.68 80 1.10 15 1690 wget 4 10.153.223.157 66.220.156.68 443 0.95 16 1690 wget 4 10.153.223.157 66.220.156.68 443 0.99 17 2852 curl 4 10.153.223.157 23.101.17.61 80 250.86 18 20337 python2.7 6 1234:ab12:2040:5020:2299:0:5:0 1234:ab12:20:9f1d:2299:dde9:0:f5 7001 62.20 19 21588 nc 6 ::1 ::1 80 0.05 20 [...] 21 22 The first line shows a connection from the "wget" process to the IPv4 23 destination address 23.23.100.231, port 80. This took 1.65 milliseconds: the 24 time from the SYN to the response. 25 26 TCP connection latency is a useful performance measure showing the time taken 27 to establish a connection. This typically involves kernel TCP/IP processing 28 and the network round trip time, and not application runtime. 29 30 tcpconnlat measures the time from any connection to the response packet, even 31 if the response is a RST (port closed). 32 33 34 USAGE message: 35 36 # ./tcpconnlat -h 37 usage: tcpconnlat [-h] [-t] [-p PID] [min_ms] 38 39 Trace TCP connects and show connection latency 40 41 positional arguments: 42 min_ms minimum duration to trace, in ms (default 0) 43 44 optional arguments: 45 -h, --help show this help message and exit 46 -t, --timestamp include timestamp on output 47 -p PID, --pid PID trace this PID only 48 49 examples: 50 ./tcpconnlat # trace all TCP connect()s 51 ./tcpconnlat -t # include timestamps 52 ./tcpconnlat -p 181 # only trace PID 181 53 ./tcpconnlat 1 # only show connects longer than 1 ms 54 ./tcpconnlat 0.1 # only show connects longer than 100 us 55 ./tcpconnlat -v # Show the BPF program 56
