tcpsynbl.bt

#!/usr/bin/env bpftrace
// tcpsynbl - Show TCP SYN backlog as a histogram.
//
// See BPF Performance Tools, Chapter 10, for an explanation of this tool.
//
// Example of usage:
//
// # ./tcpsynbl.bt
// Attaching 4 probes...
// Tracing SYN backlog size. Ctrl-C to end.
// ^C
// @backlog[backlog limit]: histogram of backlog size
//
//
// @backlog[500]:
// [0]                 2266 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@|
// [1]                    3 |                                                    |
// [2, 4)                 1 |                                                    |
//
// This output shows that for the backlog limit of 500, there were 2266 SYN
// arrivals where the backlog was zero, three where the backlog was one, and
// one where the backlog was either two or three. This indicates that we are
// nowhere near this limit.
//
// Copyright (c) 2019 Brendan Gregg.
// This was originally created for the BPF Performance Tools book
// published by Addison Wesley. ISBN-13: 9780136554820
// When copying or porting, include this comment.
//
// 19-Apr-2019  Brendan Gregg   Created this.

#ifndef BPFTRACE_HAVE_BTF
#include <net/sock.h>
#endif

BEGIN
{
  printf("Tracing SYN backlog size. Ctrl-C to end.\n");
}

kprobe:tcp_v4_syn_recv_sock,
kprobe:tcp_v6_syn_recv_sock
{
  $sock = (struct sock *)arg0;
  @backlog[$sock.sk_max_ack_backlog & 0xffffffff] = hist($sock.sk_ack_backlog);
  if ($sock.sk_ack_backlog > $sock.sk_max_ack_backlog) {
    time("%H:%M:%S dropping a SYN.\n");
  }
}

END
{
  printf("\n@backlog[backlog limit]: histogram of backlog size\n");
}