Documentation of tcptop (the Linux BPF CO-RE version). It is usually shipped as libbpf-tcptop. Description: Trace sending and received operation over IP. Example output: # ./tcptop 12:20:00 loadavg: 0.00 0.00 0.00 1/407 1987822 PID COMM LADDR RADDR RX_KB TX_KB 1987802 wget 127.0.0.1:44960 127.0.0.1:443 6 0 1987815 wget 127.0.0.1:44968 127.0.0.1:443 6 0 2770 stunnel 127.0.0.1:51460 127.0.0.1:80 4 0 2770 stunnel 127.0.0.1:51452 127.0.0.1:80 4 0 1936412 sshd 10.71.56.137:22 10.71.8.14:45682 0 2 1987805 curl 127.0.0.1:44964 127.0.0.1:443 1 0 1987818 curl 127.0.0.1:44972 127.0.0.1:443 1 0 2770 stunnel 127.0.0.1:51456 127.0.0.1:80 0 0 2770 stunnel 127.0.0.1:51464 127.0.0.1:80 0 0 1918977 sshd 10.71.56.137:22 10.71.8.14:51046 0 0 PID COMM LADDR6 RADDR6 RX_KB TX_KB 2770 stunnel ::ffff:127.0.0.1:443 ::ffff:127.0.0.1:44960 0 6 2770 stunnel ::ffff:127.0.0.1:443 ::ffff:127.0.0.1:44968 0 6 2158 server ::ffff:127.0.0.1:80 ::ffff:127.0.0.1:51452 0 4 2158 server ::ffff:127.0.0.1:80 ::ffff:127.0.0.1:51460 0 4 2770 stunnel ::ffff:127.0.0.1:443 ::ffff:127.0.0.1:44964 0 1 2770 stunnel ::ffff:127.0.0.1:443 ::ffff:127.0.0.1:44972 0 1 2158 server ::ffff:127.0.0.1:80 ::ffff:127.0.0.1:51464 0 0 2158 server ::ffff:127.0.0.1:80 ::ffff:127.0.0.1:51456 0 0 USAGE message: # ./tcptop -h Trace sending and received operation over IP. USAGE: tcptop [-h] [-p PID] [interval] [count] EXAMPLES: tcptop # TCP top, refresh every 1s tcptop -p 1216 # only trace PID 1216 tcptop -c path # only trace the given cgroup path tcptop 5 10 # 5s summaries, 10 times -4, --ipv4 trace IPv4 family only -6, --ipv6 trace IPv6 family only -c, --cgroup=/sys/fs/cgroup/unified Trace process in cgroup path -C, --noclear Don't clear the screen -p, --pid=PID Process ID to trace -r, --rows=ROWS Maximum rows to print, default 20 -s, --sort=SORT Sort columns, default all [all, sent, received] -S, --nosummary Skip system summary line -v, --verbose Verbose debug output -?, --help Give this help list --usage Give a short usage message -V, --version Print program version Mandatory or optional arguments to long options are also mandatory or optional for any corresponding short options. Report bugs to https://github.com/iovisor/bcc/tree/master/libbpf-tools.