tcpdrop.bt(8) System Manager's Manual tcpdrop.bt(8)

# [NAME](#NAME)

tcpdrop.bt - Trace kernel-based TCP packet drops with details. Uses Linux bpftrace/eBPF

# [SYNOPSIS](#SYNOPSIS)

**tcpdrop.bt**

# [DESCRIPTION](#DESCRIPTION)

This tool traces TCP packets or segments that were dropped by the kernel, and shows details from the IP and TCP headers, the socket state, and the kernel stack trace. This is useful for debugging cases of high kernel drops, which can cause timer-based retransmits and performance issues.

This tool works using dynamic tracing of the tcp\_drop() kernel function, which requires a recent kernel version.

This tool is limited to ipv4, and cannot parse tcpflags as bpftrace currently cannot parse socket buffers in the way that bcc can.

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bpftrace.

# [EXAMPLES](#EXAMPLES)

[Trace all tcp drops:](#Trace)

\# **tcpdrop.bt**

# [FIELDS](#FIELDS)

[TIME](#TIME)

Time of the call, in HH:MM:SS format.

[PID](#PID)

Process ID that was on-CPU during the drop. This may be unrelated, as drops can occur on the receive interrupt and be unrelated to the PID that was interrupted.

[COMM](#COMM)

Process name

[SADDR:SPORT](#SADDR:SPORT)

Source IP address and source TCP port.

[DADDR:DPORT](#DADDR:DPORT)

Destination IP address and destination TCP port.

[STATE](#STATE)

TCP session state ("ESTABLISHED", etc).

# [OVERHEAD](#OVERHEAD)

This traces the kernel tcp\_drop() function, which should be low frequency, and therefore the overhead of this tool should be negligible.

As always, test and understand this tools overhead for your types of workloads before production use.

# [SOURCE](#SOURCE)

This is from bpftrace

https://github.com/bpftrace/bpftrace

Also look in the bpftrace distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

This is a bpftrace version of the bcc tool of the same name. The bcc tool may provide more options and customizations.

https://github.com/iovisor/bcc

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Brendan Gregg, adapted for bpftrace by Dale Hamel

# [SEE ALSO](#SEE_ALSO)

[tcplife.bt(8)](/man/enterprise-packages/bpftrace/tcplife.bt.8), [tcpaccept.bt(8)](/man/enterprise-packages/bpftrace/tcpaccept.bt.8), [tcpconnect.bt(8)](/man/enterprise-packages/bpftrace/tcpconnect.bt.8), [tcptop(8)](/man/enterprise-packages/bpftrace/tcptop.8)

2018-11-24 USER COMMANDS

---

Document: tcpdrop.bt(8) from bpftrace 0.27.0-r1 (Chainguard OS)
Source: https://github.com/bpftrace/bpftrace