tcpaccept.bt(8) System Manager's Manual tcpaccept.bt(8)

# [NAME](#NAME)

tcpaccept.bt - Trace TCP passive connections (accept()). Uses bpftrace/eBPF

# [SYNOPSIS](#SYNOPSIS)

**tcpaccept.bt**

# [DESCRIPTION](#DESCRIPTION)

This tool traces passive TCP connections (eg, via an accept() syscall; connect() are active connections). This can be useful for general troubleshooting to see what new connections the local server is accepting.

This uses dynamic tracing of the kernel inet\_csk\_accept() socket function (from tcp\_prot.accept), and will need to be modified to match kernel changes.

This tool only traces successful TCP accept()s. Connection attempts to closed ports will not be shown (those can be traced via other functions).

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bpftrace.

# [EXAMPLES](#EXAMPLES)

[Trace all passive TCP connections (accept()s):](#Trace)

\# **tcpaccept.bt**

# [FIELDS](#FIELDS)

[TIME(s)](#TIME%28s%29)

Time of the call, in HH:MM:SS format.

[PID](#PID)

Process ID

[COMM](#COMM)

Process name

[RADDR](#RADDR)

Remote IP address.

[RPORT](#RPORT)

Remote port.

[LADDR](#LADDR)

Local IP address.

[LPORT](#LPORT)

Local port

[BL](#BL)

Current accept backlog vs maximum backlog

# [OVERHEAD](#OVERHEAD)

This traces the kernel inet\_csk\_accept function and prints output for each event. The rate of this depends on your server application. If it is a web or proxy server accepting many tens of thousands of connections per second, then the overhead of this tool may be measurable (although, still a lot better than tracing every packet). If it is less than a thousand a second, then the overhead is expected to be negligible. Test and understand this overhead before use.

# [SOURCE](#SOURCE)

This is from bpftrace

https://github.com/bpftrace/bpftrace

Also look in the bpftrace distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

This is a bpftrace version of the bcc tool of the same name. The bcc tool may provide more options and customizations.

https://github.com/iovisor/bcc

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Brendan Gregg, adapted for bpftrace by Dale Hamel

# [SEE ALSO](#SEE_ALSO)

[tcpconnect.bt(8)](/man/enterprise-packages/bpftrace/tcpconnect.bt.8), [funccount(8)](/man/enterprise-packages/bpftrace/funccount.8), [tcpdump(8)](/man/enterprise-packages/bpftrace/tcpdump.8)

2018-10-24 USER COMMANDS

---

Document: tcpaccept.bt(8) from bpftrace 0.27.1-r0 (Chainguard OS)
Source: https://github.com/bpftrace/bpftrace