tcpretrans(8) System Manager's Manual tcpretrans(8)

# [NAME](#NAME)

tcpretrans - Trace or count TCP retransmits and TLPs. Uses Linux eBPF/bcc.

# [SYNOPSIS](#SYNOPSIS)

**tcpretrans \[-h] \[-s] \[-l] \[-c] \[-4 | -6]**

# [DESCRIPTION](#DESCRIPTION)

This traces TCP retransmits, showing address, port, and TCP state information, and sometimes the PID (although usually not, since retransmits are usually sent by the kernel on timeouts). To keep overhead very low, only the TCP retransmit functions are traced. This does not trace every packet (like [tcpdump(8)](/man/enterprise-packages/bcc/tcpdump.8) or a packet sniffer). Optionally, it can count retransmits over a user signalled interval to spot potentially dropping network paths the flows are traversing.

This uses dynamic tracing of the kernel tcp\_retransmit\_skb() and tcp\_send\_loss\_probe() functions, and will need to be updated to match kernel changes to these functions.

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bcc.

# [OPTIONS](#OPTIONS)

[-h](#h)

Print usage message.

[-s](#s)

Display TCP sequence numbers.

[-l](#l)

Include tail loss probe attempts (in some cases the kernel may not complete the TLP send).

[-c](#c)

Count occurring retransmits per flow.

-4

Trace IPv4 family only.

-6

Trace IPv6 family only.

# [EXAMPLES](#EXAMPLES)

[Trace TCP retransmits:](#Trace)

\# **tcpretrans**

[Trace TCP retransmits and TLP attempts:](#Trace~2)

\# **tcpretrans -l**

[Trace IPv4 family only:](#Trace~3)

\# **tcpretrans -4**

[Trace IPv6 family only:](#Trace~4)

\# **tcpretrans -6**

# [FIELDS](#FIELDS)

[TIME](#TIME)

Time of the retransmit.

[PID](#PID)

Process ID that was on-CPU. This is less useful than it might sound, as it may usually be 0, for the kernel, for timer-based retransmits.

[IP](#IP)

IP address family (4 or 6).

[LADDR](#LADDR)

Local IP address.

[LPORT](#LPORT)

Local port.

[T>](#T_)

Type of event: R> == retransmit, L> == tail loss probe.

[RADDR](#RADDR)

Remote IP address.

[RPORT](#RPORT)

Remote port.

[STATE](#STATE)

TCP session state.

[SEQ](#SEQ)

TCP sequence.

[RETRANSMITS](#RETRANSMITS)

Accumulated occurred retransmits since start.

# [OVERHEAD](#OVERHEAD)

Should be negligible: TCP retransmit events should be low (<1000/s), and the low overhead this tool adds to each event should make the cost negligible.

# [SOURCE](#SOURCE)

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Brendan Gregg

# [SEE ALSO](#SEE_ALSO)

[tcpconnect(8)](/man/enterprise-packages/bcc/tcpconnect.8), [tcpaccept(8)](/man/enterprise-packages/bcc/tcpaccept.8)

2016-02-14 USER COMMANDS

---

Document: tcpretrans(8) from bcc 0.37.0-r2 (Chainguard OS)
Source: https://github.com/iovisor/bcc