---
name: "tcpdrop-bpfcc"
section: "8"
platform: "linux"
package: "bpfcc-tools"
version: "0.31.0+ds-7"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/tcpdrop-bpfcc"
---

# tcpdrop-bpfcc(8)

Trace kernel-based TCP packet drops with details. Uses Linux eBPF/bcc.

## NAME

tcpdrop - Trace kernel-based TCP packet drops with details. Uses Linux eBPF/bcc.

## SYNOPSIS

**tcpdrop \[-4 \| -6\] \[-h\]**

## DESCRIPTION

This tool traces TCP packets or segments that were dropped by the kernel, and shows details from the IP and TCP headers, the socket state, and the kernel stack trace. This is useful for debugging cases of high kernel drops, which can cause timer-based retransmits and performance issues.

This tool works using dynamic tracing of the tcp\_drop() kernel function, which requires a recent kernel version.

Since this uses BPF, only the root user can use this tool.

## REQUIREMENTS

CONFIG\_BPF and bcc.

## OPTIONS

- \-4

  Trace IPv4 family only.

- \-6

  Trace IPv6 family only.

- \-h

  Print usage message.

## EXAMPLES

- Trace kernel-based TCP packet drops with details:

  \# **tcpdrop**

- Trace IPv4 family only:

  \# **tcpdrop -4**

- Trace IPv6 family only:

  \# **tcpdrop -6**

## FIELDS

- TIME

  Time of the drop, in HH:MM:SS format.

- PID

  Process ID that was on-CPU during the drop. This may be unrelated, as drops can occur on the receive interrupt and be unrelated to the PID that was interrupted.

- IP

  IP address family (4 or 6)

- SADDR

  Source IP address.

- SPORT

  Source TCP port.

- DADDR

  Destination IP address.

- DPORT

  Destionation TCP port.

- STATE

  TCP session state ("ESTABLISHED", etc).

- FLAGS

  TCP flags ("SYN", etc).

## OVERHEAD

This traces the kernel tcp\_drop() function, which should be low frequency, and therefore the overhead of this tool should be negligible.

As always, test and understand this tools overhead for your types of workloads before production use.

## SOURCE

This is from bcc.

-

  https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

## OS

Linux

## STABILITY

Unstable - in development.

## AUTHOR

Brendan Gregg

## SEE ALSO

tcplife(8), tcpaccept(8), tcpconnect(8), tcptop(8)