examples: ./tcpconnect # trace all TCP connect()s ./tcpconnect -t # include timestamps ./tcpconnect -d # include DNS queries associated with connects ./tcpconnect -p 181 # only trace PID 181 ./tcpconnect -P 80 # only trace port 80 ./tcpconnect -P 80,81 # only trace port 80 and 81 ./tcpconnect -4 # only trace IPv4 family ./tcpconnect -6 # only trace IPv6 family ./tcpconnect -U # include UID ./tcpconnect -u 1000 # only trace UID 1000 ./tcpconnect -c # count connects per src ip and dest ip/port ./tcpconnect -L # include LPORT while printing outputs ./tcpconnect --cgroupmap mappath # only trace cgroups in this BPF map ./tcpconnect --mntnsmap mappath # only trace mount namespaces in the map
examples: ./tcpaccept # trace all TCP accept()s ./tcpaccept -t # include timestamps ./tcpaccept -P 80,81 # only trace port 80 and 81 ./tcpaccept -p 181 # only trace PID 181 ./tcpaccept --cgroupmap mappath # only trace cgroups in this BPF map ./tcpaccept --mntnsmap mappath # only trace mount namespaces in the map ./tcpaccept -4 # trace IPv4 family only ./tcpaccept -6 # trace IPv6 family only
# ./tcpretrans -l TIME PID IP LADDR:LPORT T> RADDR:RPORT STATE 01:55:45 0 4 10.153.223.157:22 R> 69.53.245.40:51601 ESTABLISHED 01:55:46 0 4 10.153.223.157:22 R> 69.53.245.40:51601 ESTABLISHED 01:55:46 0 4 10.153.223.157:22 R> 69.53.245.40:51601 ESTABLISHED 01:55:53 0 4 10.153.223.157:22 L> 69.53.245.40:46444 ESTABLISHED 01:56:06 0 4 10.153.223.157:22 R> 69.53.245.40:46444 ESTABLISHED
T 列 中的“L”这些都是尝试:内核可能发送了一个TLP，但在某些情况下它可能最终没有被发送。
L>: 表示数据包是从本地地址(LADDR)发送到远程地址(RADDR)的。
R>: 表示数据包是从远程地址(RADDR)发送到本地地址(LADDR)的。
要快速发现重传流，可以使用-c标志。它将计算每个流中发生的重传次数。
1 2 3 4 5 6 7
# ./tcpretrans.py -c Tracing retransmits ... Hit Ctrl-C to end ^C LADDR:LPORT RADDR:RPORT RETRANSMITS 192.168.10.50:60366 <-> 172.217.21.194:443 700 192.168.10.50:666 <-> 172.213.11.195:443 345 192.168.10.50:366 <-> 172.212.22.194:443 211
其他的一些操作
1 2 3 4 5 6 7 8 9 10 11 12 13
optional arguments: -h, --help show this help message and exit -s, --sequence display TCP sequence numbers -l, --lossprobe include tail loss probe attempts -c, --count count occurred retransmits per flow -4, --ipv4 trace IPv4 family only -6, --ipv6 trace IPv6 family only
examples: ./tcpretrans # trace TCP retransmits ./tcpretrans -l # include TLP attempts ./tcpretrans -4 # trace IPv4 family only ./tcpretrans -6 # trace IPv6 family only
optional arguments: -h, --help show this help message and exit -t, --timestamp include timestamp on output -p PID, --pid PID trace this PID only -N NETNS, --netns NETNS trace this Network Namespace only --cgroupmap CGROUPMAP trace cgroups in this BPF map only --mntnsmap MNTNSMAP trace mount namespaces in this BPF map only -4, --ipv4 trace IPv4 family only -6, --ipv6 trace IPv6 family only -v, --verbose include Network Namespace in the output [root@liruilongs ~]#
examples: ./tcpconnlat # trace all TCP connect()s ./tcpconnlat 1 # trace connection latency slower than 1 ms ./tcpconnlat 0.1 # trace connection latency slower than 100 us ./tcpconnlat -t # include timestamps ./tcpconnlat -p 181 # only trace PID 181 ./tcpconnlat -L # include LPORT while printing outputs ./tcpconnlat -4 # trace IPv4 family only ./tcpconnlat -6 # trace IPv6 family only
examples: ./tcplife # trace all TCP connect()s ./tcplife -t # include time column (HH:MM:SS) ./tcplife -w # wider columns (fit IPv6) ./tcplife -stT # csv output, with times & timestamps ./tcplife -p 181 # only trace PID 181 ./tcplife -L 80 # only trace local port 80 ./tcplife -L 80,81 # only trace local ports 80 and 81 ./tcplife -D 80 # only trace remote port 80 ./tcplife -4 # only trace IPv4 family ./tcplife -6 # only trace IPv6 family
OLDSTATE -> NEWSTATE MS CLOSE -> SYN_SENT 0.000 SYN_SENT -> ESTABLISHED 1.373 ESTABLISHED -> FIN_WAIT1 176.042 FIN_WAIT1 -> FIN_WAIT2 0.536 FIN_WAIT2 -> CLOSE 0.006
其他的一些 Demo
1 2 3 4 5 6 7 8 9 10 11 12
examples: ./tcpstates # trace all TCP state changes ./tcpstates -t # include timestamp column ./tcpstates -T # include time column (HH:MM:SS) ./tcpstates -w # wider columns (fit IPv6) ./tcpstates -stT # csv output, with times & timestamps ./tcpstates -Y # log events to the systemd journal ./tcpstates -L 80 # only trace local port 80 ./tcpstates -L 80,81 # only trace local ports 80 and 81 ./tcpstates -D 80 # only trace remote port 80 ./tcpstates -4 # trace IPv4 family only ./tcpstates -6 # trace IPv6 family only
examples: ./tcpsubnet # Trace TCP sent to the default subnets: # 127.0.0.1/32,10.0.0.0/8,172.16.0.0/12, # 192.168.0.0/16,0.0.0.0/0 ./tcpsubnet -f K # Trace TCP sent to the default subnets # aggregated in KBytes. ./tcpsubnet 10.80.0.0/24 # Trace TCP sent to 10.80.0.0/24 only ./tcpsubnet -J # Format the output in JSON.
examples: ./tcptop # trace TCP send/recv by host ./tcptop -C # don't clear the screen ./tcptop -p 181 # only trace PID 181 ./tcptop --cgroupmap ./mappath # only trace cgroups in this BPF map ./tcptop --mntnsmap mappath # only trace mount namespaces in the map ./tcptop -4 # trace IPv4 family only ./tcptop -6 # trace IPv6 family only
Examples: ./solisten.py # Stream socket listen ./solisten.py -p 1234 # Stream socket listen for specified PID only ./solisten.py --netns 4242 # " for the specified network namespace ID only ./solisten.py --show-netns # Show network ns ID (useful for containers)
