Gecko [ www.jobworksschool.com ]

Name	Size	Permission	Date
lib	[ DIR ]	drwxr-xr-x	2025-11-05 21:34
argdist_example.txt	22.49 KB	-rw-r--r--	2023-12-08 15:36
bashreadline_example.txt	882 B	-rw-r--r--	2023-12-08 15:36
bindsnoop_example.txt	4.42 KB	-rw-r--r--	2023-12-08 15:36
biolatency_example.txt	23.46 KB	-rw-r--r--	2023-12-08 15:36
biolatpcts_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
biopattern_example.txt	1.37 KB	-rw-r--r--	2023-12-08 15:36
biosnoop_example.txt	3.47 KB	-rw-r--r--	2023-12-08 15:36
biotop_example.txt	9.11 KB	-rw-r--r--	2023-12-08 15:36
bitesize_example.txt	4.98 KB	-rw-r--r--	2023-12-08 15:36
bpflist_example.txt	2.13 KB	-rw-r--r--	2023-12-08 15:36
btrfsdist_example.txt	9.32 KB	-rw-r--r--	2023-12-08 15:36
btrfsslower_example.txt	6.65 KB	-rw-r--r--	2023-12-08 15:36
cachestat_example.txt	3.92 KB	-rw-r--r--	2023-12-08 15:36
cachetop_example.txt	3.83 KB	-rw-r--r--	2023-12-08 15:36
capable_example.txt	6.5 KB	-rw-r--r--	2023-12-08 15:36
cobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
compactsnoop_example.txt	9.92 KB	-rw-r--r--	2023-12-08 15:36
cpudist_example.txt	16.48 KB	-rw-r--r--	2023-12-08 15:36
cpuunclaimed_example.txt	15.2 KB	-rw-r--r--	2023-12-08 15:36
criticalstat_example.txt	4.81 KB	-rw-r--r--	2023-12-08 15:36
cthreads_example.txt	2.08 KB	-rw-r--r--	2023-12-08 15:36
dbslower_example.txt	3.89 KB	-rw-r--r--	2023-12-08 15:36
dbstat_example.txt	6.5 KB	-rw-r--r--	2023-12-08 15:36
dcsnoop_example.txt	4.27 KB	-rw-r--r--	2023-12-08 15:36
dcstat_example.txt	3.26 KB	-rw-r--r--	2023-12-08 15:36
deadlock_example.txt	16.25 KB	-rw-r--r--	2023-12-08 15:36
dirtop_example.txt	4.98 KB	-rw-r--r--	2023-12-08 15:36
drsnoop_example.txt	5 KB	-rw-r--r--	2023-12-08 15:36
execsnoop_example.txt	6.64 KB	-rw-r--r--	2023-12-08 15:36
exitsnoop_example.txt	6.22 KB	-rw-r--r--	2023-12-08 15:36
ext4dist_example.txt	8.78 KB	-rw-r--r--	2023-12-08 15:36
ext4slower_example.txt	11.07 KB	-rw-r--r--	2023-12-08 15:36
filegone_example.txt	743 B	-rw-r--r--	2023-12-08 15:36
filelife_example.txt	2.04 KB	-rw-r--r--	2023-12-08 15:36
fileslower_example.txt	5.58 KB	-rw-r--r--	2023-12-08 15:36
filetop_example.txt	6.8 KB	-rw-r--r--	2023-12-08 15:36
funccount_example.txt	13.29 KB	-rw-r--r--	2023-12-08 15:36
funcinterval_example.txt	15.28 KB	-rw-r--r--	2023-12-08 15:36
funclatency_example.txt	20.98 KB	-rw-r--r--	2023-12-08 15:36
funcslower_example.txt	6.63 KB	-rw-r--r--	2023-12-08 15:36
gethostlatency_example.txt	1.29 KB	-rw-r--r--	2023-12-08 15:36
hardirqs_example.txt	37.05 KB	-rw-r--r--	2023-12-08 15:36
inject_example.txt	6.67 KB	-rw-r--r--	2023-12-08 15:36
javacalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
javaflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
javagc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
javaobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
javastat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
javathreads_example.txt	2.08 KB	-rw-r--r--	2023-12-08 15:36
killsnoop_example.txt	1.31 KB	-rw-r--r--	2023-12-08 15:36
klockstat_example.txt	8.34 KB	-rw-r--r--	2023-12-08 15:36
kvmexit_example.txt	11.63 KB	-rw-r--r--	2023-12-08 15:36
llcstat_example.txt	3.24 KB	-rw-r--r--	2023-12-08 15:36
mdflush_example.txt	1.74 KB	-rw-r--r--	2023-12-08 15:36
memleak_example.txt	10.02 KB	-rw-r--r--	2023-12-08 15:36
mountsnoop_example.txt	1.45 KB	-rw-r--r--	2023-12-08 15:36
mysqld_qslower_example.txt	2.3 KB	-rw-r--r--	2023-12-08 15:36
netqtop_example.txt	12.2 KB	-rw-r--r--	2023-12-08 15:36
nfsdist_example.txt	8.31 KB	-rw-r--r--	2023-12-08 15:36
nfsslower_example.txt	7.68 KB	-rw-r--r--	2023-12-08 15:36
nodegc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
nodestat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
offcputime_example.txt	19.2 KB	-rw-r--r--	2023-12-08 15:36
offwaketime_example.txt	37.36 KB	-rw-r--r--	2023-12-08 15:36
oomkill_example.txt	1.88 KB	-rw-r--r--	2023-12-08 15:36
opensnoop_example.txt	10.33 KB	-rw-r--r--	2023-12-08 15:36
perlcalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
perlflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
perlstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
phpcalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
phpflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
phpstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
pidpersec_example.txt	677 B	-rw-r--r--	2023-12-08 15:36
ppchcalls_example.txt	6.93 KB	-rw-r--r--	2023-12-08 15:36
profile_example.txt	31.08 KB	-rw-r--r--	2023-12-08 15:36
pythoncalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
pythonflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
pythongc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
pythonstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
rdmaucma_example.txt	1.94 KB	-rw-r--r--	2023-12-08 15:36
readahead_example.txt	3.17 KB	-rw-r--r--	2023-12-08 15:36
reset-trace_example.txt	9.15 KB	-rw-r--r--	2023-12-08 15:36
rubycalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
rubyflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
rubygc_example.txt	3.78 KB	-rw-r--r--	2023-12-08 15:36
rubyobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
rubystat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
runqlat_example.txt	31.3 KB	-rw-r--r--	2023-12-08 15:36
runqlen_example.txt	11.85 KB	-rw-r--r--	2023-12-08 15:36
runqslower_example.txt	2.13 KB	-rw-r--r--	2023-12-08 15:36
shmsnoop_example.txt	2.73 KB	-rw-r--r--	2023-12-08 15:36
slabratetop_example.txt	5.22 KB	-rw-r--r--	2023-12-08 15:36
sofdsnoop_example.txt	3.14 KB	-rw-r--r--	2023-12-08 15:36
softirqs_example.txt	11.02 KB	-rw-r--r--	2023-12-08 15:36
solisten_example.txt	2.3 KB	-rw-r--r--	2023-12-08 15:36
sslsniff_example.txt	6.74 KB	-rw-r--r--	2023-12-08 15:36
stackcount_example.txt	21.45 KB	-rw-r--r--	2023-12-08 15:36
statsnoop_example.txt	3.02 KB	-rw-r--r--	2023-12-08 15:36
swapin.txt	2.57 KB	-rw-r--r--	2023-12-08 15:36
swapin_example.txt	1.39 KB	-rw-r--r--	2023-12-08 15:36
syncsnoop_example.txt	387 B	-rw-r--r--	2023-12-08 15:36
syscount_example.txt	6.27 KB	-rw-r--r--	2023-12-08 15:36
tclcalls_example.txt	3.91 KB	-rw-r--r--	2023-12-08 15:36
tclflow_example.txt	5.88 KB	-rw-r--r--	2023-12-08 15:36
tclobjnew_example.txt	2.97 KB	-rw-r--r--	2023-12-08 15:36
tclstat_example.txt	2.98 KB	-rw-r--r--	2023-12-08 15:36
tcpaccept_example.txt	2.76 KB	-rw-r--r--	2023-12-08 15:36
tcpcong_example.txt	33.31 KB	-rw-r--r--	2023-12-08 15:36
tcpconnect_example.txt	6.27 KB	-rw-r--r--	2023-12-08 15:36
tcpconnlat_example.txt	2.55 KB	-rw-r--r--	2023-12-08 15:36
tcpdrop_example.txt	1.95 KB	-rw-r--r--	2023-12-08 15:36
tcplife_example.txt	6.83 KB	-rw-r--r--	2023-12-08 15:36
tcpretrans_example.txt	3.85 KB	-rw-r--r--	2023-12-08 15:36
tcprtt_example.txt	9.83 KB	-rw-r--r--	2023-12-08 15:36
tcpstates_example.txt	2.84 KB	-rw-r--r--	2023-12-08 15:36
tcpsubnet_example.txt	5.37 KB	-rw-r--r--	2023-12-08 15:36
tcpsynbl_example.txt	1.15 KB	-rw-r--r--	2023-12-08 15:36
tcptop_example.txt	5.75 KB	-rw-r--r--	2023-12-08 15:36
tcptracer_example.txt	1.98 KB	-rw-r--r--	2023-12-08 15:36
threadsnoop_example.txt	1.07 KB	-rw-r--r--	2023-12-08 15:36
tplist_example.txt	4.4 KB	-rw-r--r--	2023-12-08 15:36
trace_example.txt	21.62 KB	-rw-r--r--	2023-12-08 15:36
ttysnoop_example.txt	3.24 KB	-rw-r--r--	2023-12-08 15:36
vfscount_example.txt	2.17 KB	-rw-r--r--	2023-12-08 15:36
vfsstat_example.txt	1.66 KB	-rw-r--r--	2023-12-08 15:36
virtiostat_example.txt	2.62 KB	-rw-r--r--	2023-12-08 15:36
wakeuptime_example.txt	33.25 KB	-rw-r--r--	2023-12-08 15:36
xfsdist_example.txt	6.77 KB	-rw-r--r--	2023-12-08 15:36
xfsslower_example.txt	6.91 KB	-rw-r--r--	2023-12-08 15:36
zfsdist_example.txt	9.52 KB	-rw-r--r--	2023-12-08 15:36
zfsslower_example.txt	7.37 KB	-rw-r--r--	2023-12-08 15:36

Rename

Demonstrations of tcplife, the Linux BPF/bcc version.

tcplife summarizes TCP sessions that open and close while tracing. For example:

# ./tcplife
PID   COMM       LADDR           LPORT RADDR           RPORT TX_KB RX_KB MS
22597 recordProg 127.0.0.1       46644 127.0.0.1       28527     0     0 0.23
3277  redis-serv 127.0.0.1       28527 127.0.0.1       46644     0     0 0.28
22598 curl       100.66.3.172    61620 52.205.89.26    80        0     1 91.79
22604 curl       100.66.3.172    44400 52.204.43.121   80        0     1 121.38
22624 recordProg 127.0.0.1       46648 127.0.0.1       28527     0     0 0.22
3277  redis-serv 127.0.0.1       28527 127.0.0.1       46648     0     0 0.27
22647 recordProg 127.0.0.1       46650 127.0.0.1       28527     0     0 0.21
3277  redis-serv 127.0.0.1       28527 127.0.0.1       46650     0     0 0.26
[...]

This caught a program, "recordProg" making a few short-lived TCP connections
to "redis-serv", lasting about 0.25 milliseconds each connection. A couple of
"curl" sessions were also traced, connecting to port 80, and lasting 91 and 121
milliseconds.

This tool is useful for workload characterisation and flow accounting:
identifying what connections are happening, with the bytes transferred.

Process names are truncated to 10 characters. By using the wide option, -w,
the column width becomes 16 characters. The IP address columns are also wider
to fit IPv6 addresses:

# ./tcplife -w
PID   COMM             IP LADDR                      LPORT RADDR                      RPORT  TX_KB  RX_KB MS
26315 recordProgramSt  4  127.0.0.1                  44188 127.0.0.1                  28527      0      0 0.21
3277  redis-server     4  127.0.0.1                  28527 127.0.0.1                  44188      0      0 0.26
26320 ssh              6  fe80::8a3:9dff:fed5:6b19   22440 fe80::8a3:9dff:fed5:6b19   22         1      1 457.52
26321 sshd             6  fe80::8a3:9dff:fed5:6b19   22    fe80::8a3:9dff:fed5:6b19   22440      1      1 458.69
26341 recordProgramSt  4  127.0.0.1                  44192 127.0.0.1                  28527      0      0 0.27
3277  redis-server     4  127.0.0.1                  28527 127.0.0.1                  44192      0      0 0.32

In this example, I uploaded a 10 Mbyte file to the server, and then downloaded
it again, using scp:

# ./tcplife
PID   COMM       LADDR           LPORT RADDR           RPORT TX_KB RX_KB MS
7715  recordProg 127.0.0.1       50894 127.0.0.1       28527     0     0 0.25
3277  redis-serv 127.0.0.1       28527 127.0.0.1       50894     0     0 0.30
7619  sshd       100.66.3.172    22    100.127.64.230  63033     5 10255 3066.79
7770  recordProg 127.0.0.1       50896 127.0.0.1       28527     0     0 0.20
3277  redis-serv 127.0.0.1       28527 127.0.0.1       50896     0     0 0.24
7793  recordProg 127.0.0.1       50898 127.0.0.1       28527     0     0 0.23
3277  redis-serv 127.0.0.1       28527 127.0.0.1       50898     0     0 0.27
7847  recordProg 127.0.0.1       50900 127.0.0.1       28527     0     0 0.24
3277  redis-serv 127.0.0.1       28527 127.0.0.1       50900     0     0 0.29
7870  recordProg 127.0.0.1       50902 127.0.0.1       28527     0     0 0.29
3277  redis-serv 127.0.0.1       28527 127.0.0.1       50902     0     0 0.30
7798  sshd       100.66.3.172    22    100.127.64.230  64925 10265     6 2176.15
[...]

You can see the 10 Mbytes received by sshd, and then later transmitted. Looks
like receive was slower (3.07 seconds) than transmit (2.18 seconds).

Timestamps can be added with -t:

# ./tcplife -t
TIME(s)   PID   COMM       LADDR           LPORT RADDR           RPORT TX_KB RX_KB MS
0.000000  5973  recordProg 127.0.0.1       47986 127.0.0.1       28527     0     0 0.25
0.000059  3277  redis-serv 127.0.0.1       28527 127.0.0.1       47986     0     0 0.29
1.022454  5996  recordProg 127.0.0.1       47988 127.0.0.1       28527     0     0 0.23
1.022513  3277  redis-serv 127.0.0.1       28527 127.0.0.1       47988     0     0 0.27
2.044868  6019  recordProg 127.0.0.1       47990 127.0.0.1       28527     0     0 0.24
2.044924  3277  redis-serv 127.0.0.1       28527 127.0.0.1       47990     0     0 0.28
3.069136  6042  recordProg 127.0.0.1       47992 127.0.0.1       28527     0     0 0.22
3.069204  3277  redis-serv 127.0.0.1       28527 127.0.0.1       47992     0     0 0.28

This shows that the recordProg process was connecting once per second.

There's also a -T for HH:MM:SS formatted times.

There's a comma separated values mode, -s. Here it is with both -t and -T
timestamps:

# ./tcplife -stT
TIME,TIME(s),PID,COMM,IP,LADDR,LPORT,RADDR,RPORT,TX_KB,RX_KB,MS
23:39:38,0.000000,7335,recordProgramSt,4,127.0.0.1,48098,127.0.0.1,28527,0,0,0.26
23:39:38,0.000064,3277,redis-server,4,127.0.0.1,28527,127.0.0.1,48098,0,0,0.32
23:39:39,1.025078,7358,recordProgramSt,4,127.0.0.1,48100,127.0.0.1,28527,0,0,0.25
23:39:39,1.025141,3277,redis-server,4,127.0.0.1,28527,127.0.0.1,48100,0,0,0.30
23:39:41,2.040949,7381,recordProgramSt,4,127.0.0.1,48102,127.0.0.1,28527,0,0,0.24
23:39:41,2.041011,3277,redis-server,4,127.0.0.1,28527,127.0.0.1,48102,0,0,0.29
23:39:42,3.067848,7404,recordProgramSt,4,127.0.0.1,48104,127.0.0.1,28527,0,0,0.30
23:39:42,3.067914,3277,redis-server,4,127.0.0.1,28527,127.0.0.1,48104,0,0,0.35
[...]

There are options for filtering on local and remote ports. Here is filtering
on local ports 22 and 80:

# ./tcplife.py -L 22,80
PID   COMM       LADDR           LPORT RADDR           RPORT TX_KB RX_KB MS
8301  sshd       100.66.3.172    22    100.127.64.230  58671     3     3 1448.52
[...]

USAGE:

# ./tcplife.py -h
usage: tcplife.py [-h] [-T] [-t] [-w] [-s] [-p PID] [-L LOCALPORT]
                  [-D REMOTEPORT] [-4 | -6]

Trace the lifespan of TCP sessions and summarize

optional arguments:
  -h, --help            show this help message and exit
  -T, --time            include time column on output (HH:MM:SS)
  -t, --timestamp       include timestamp on output (seconds)
  -w, --wide            wide column output (fits IPv6 addresses)
  -s, --csv             comma separated values output
  -p PID, --pid PID     trace this PID only
  -L LOCALPORT, --localport LOCALPORT
                        comma-separated list of local ports to trace.
  -D REMOTEPORT, --remoteport REMOTEPORT
                        comma-separated list of remote ports to trace.
  -4, --ipv4            trace IPv4 family only
  -6, --ipv6            trace IPv6 family only

examples:
    ./tcplife           # trace all TCP connect()s
    ./tcplife -t        # include time column (HH:MM:SS)
    ./tcplife -w        # wider columns (fit IPv6)
    ./tcplife -stT      # csv output, with times & timestamps
    ./tcplife -p 181    # only trace PID 181
    ./tcplife -L 80     # only trace local port 80
    ./tcplife -L 80,81  # only trace local ports 80 and 81
    ./tcplife -D 80     # only trace remote port 80
    ./tcplife -4        # only trace IPv4 family
    ./tcplife -6        # only trace IPv6 family