NAME

       tcpsubnet - Summarize and aggregate IPv4 TCP traffic by subnet.

SYNOPSIS

       tcpsubnet [-h] [-v] [-J] [-f FORMAT] [-i INTERVAL] [subnets]

DESCRIPTION

       This  tool summarizes and aggregates IPv4 TCP sent to the subnets passed in argument and prints to stdout
       on a fixed interval.

       This uses dynamic tracing of kernel TCP send/receive functions, and will need  to  be  updated  to  match
       kernel changes.

       The  traced  data  is  summarized  in-kernel  using a BPF map to reduce overhead.  At very high TCP event
       rates, the overhead may still be measurable.  See the OVERHEAD section for more details.

       Since this uses BPF, only the root user can use this tool.

REQUIREMENTS

       CONFIG_BPF and bcc.

OPTIONS

       -h     Print USAGE message.

       -v     Run in verbose mode. Will output subnet evaluation and the BPF program

       -J     Format output in JSON.

       -i     Interval between updates, seconds (default 1).

       -f     Format output units. Supported values are bkmBKM. When using kmKM the output will  be  rounded  to
              floor.

       subnets
              Comma  separated  list  of  subnets. Traffic will be categorized in theses subnets. Order matters.
              (default 127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,0.0.0.0/0)

EXAMPLES

       Summarize TCP traffic by the default subnets:
              # tcpsubnet

       Summarize all TCP traffic:
              # tcpsubnet 0.0.0.0/0

       Summarize all TCP traffic and output in JSON and Kb:
              # tcpsubnet -J -fk 0.0.0.0/0

FIELDS

       (Standad output) Left hand side column:
              Subnet

       (Standard output) Right hand side column:
              Aggregate traffic in units passed as argument

       (JSON output) date
              Current date formatted in the system locale

       (JSON output) time
              Current time formatted in the system locale

       (JSON output) entries
              Map of subnets to aggregates. Values will be in format passed to -f

OVERHEAD

       This traces all tcp_sendmsg function calls in the TCP/IP stack.  It summarizes data in-kernel  to  reduce
       overhead.   A  simple  iperf  test (v2.0.5) with the default values shows a loss of ~5% throughput. On 10
       runs without tcpsubnet running the average throughput  was  32.42Gb/s,  with  tcpsubnet  enabled  it  was
       31.26Gb/s.   This  is not meant to be used as a long running service. Use it for troubleshooting or for a
       controlled interval. As always, try it out in a test environment first.

SOURCE

       This is from bcc.

              https://github.com/iovisor/bcc

       Also look in the bcc distribution for a companion _examples.txt file containing  example  usage,  output,
       and commentary for this tool.

OS

       Linux

STABILITY

       Unstable - in development.

AUTHOR

       Rodrigo Manyari

INSPIRATION

       tcptop(8) by Brendan Gregg

SEE ALSO

       netlink(7)

USER COMMANDS                                      2018-03-01                                       tcpsubnet(8)