---
name: "tcplife.bt"
section: "8"
platform: "linux"
package: "bpftrace"
version: "0.27.0-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/tcplife.bt"
---

# tcplife.bt(8)

Trace TCP session lifespans with connection details. Uses bpftrace/eBPF.

## NAME

tcplife.bt - Trace TCP session lifespans with connection details. Uses bpftrace/eBPF.

## SYNOPSIS

**tcplife**

## DESCRIPTION

This tool shows the lifespan of TCP sessions that open and close while tracing, and shows the duration and throughput statistics. For efficiency, this tool only instruments TCP state changes, rather than all packets.

This tool works by using the sock:inet\_sock\_set\_state tracepoint, which was added in Linux 4.16.

Since this uses BPF, only the root user can use this tool.

## REQUIREMENTS

CONFIG\_BPF, bpftrace, and the sock:inet\_sock\_set\_state tracepoint (Linux 4.16+).

## EXAMPLES

- Show TCP sessions with details:

  \# **tcplife.bt**

## FIELDS

- PID

  Process ID

- COMM

  Process name

- LADDR

  Local IP address.

- LPORT

  Local port.

- RADDR

  Remote IP address.

- RPORT

  Remote port.

- TX\_KB

  Total transmitted Kbytes.

- RX\_KB

  Total received Kbytes.

- MS

  Lifespan of the session, in milliseconds.

## OVERHEAD

This traces the kernel TCP set state function, which should be called much less often than send/receive tracing, and therefore have lower overhead. The overhead of the tool is relative to the rate of new TCP sessions: if this is high, over 10,000 per second, then there may be noticeable overhead just to print out 10k lines of formatted output per second.

You can find out the rate of new TCP sessions using "sar -n TCP 1", and adding the active/s and passive/s columns.

As always, test and understand this tools overhead for your types of workloads before production use.

## SOURCE

This tool originated from BCC:

-

  https://github.com/iovisor/bcc

The BCC version has many command line options for customizing the output.

This bpftrace version originated from the book "BPF Performance Tools", published by Addison Wesley (2019):

-

  http://www.brendangregg.com/bpf-performance-tools-book.html

See the book for more documentation on this tool.

This bpftrace version is in the bpftrace repository:

-

  https://github.com/bpftrace/bpftrace

Also look in the bpftrace distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

## OS

Linux

## STABILITY

Unstable - in development.

## AUTHOR

Brendan Gregg

## SEE ALSO

tcptop(8)