tcp_probe no workey?

tcp_probe is a very handy utility in Linux to observe TCP flows. Implemented as a Linux kernel module, all you have to do is:

$: modprobe tcp_probe [port=]
$: cat /proc/net/tcpprobe > logfile.out

…and you’ll get clear statistics about whatever TCP flows go through ‘port’ (and of all TCP flows if you specify the port as 0).

Earlier today, I ran into a situation where tcp_probe would stop logging flows after a couple of seconds, and it always seemed to be around the 10th second in an experiment I was trying (which involved iperf-ing over a wireless link). Some quick searches made it clear that others were encountering it as well, but no one really had a solution for them. Odd.

And what do you do when Google can’t help you find the answer? You look through the source code of course!

Within a few seconds of going through tcp_probe.c, I had my answer before me. Have a look at lines 47-49 and you’ll know what was wrong in my case.

static int full __read_mostly;
MODULE_PARM_DESC(full, "Full log (1=every ack packet received, 0=only cwnd changes)");
module_param(full, int, 0);

In short, I was on a wireless channel without any nodes apart from my wireless interface and the access point, and my congestion window size was getting maxed out around the 10th second. Since tcpprobe by default logs a packet only if the congestion window size changes, I couldn’t see any more packets of the flow I was looking at in /proc/net/tcpprobe.

So the solution?

$: modprobe tcp_probe <args> full=1

Note that you might want to look at the log buffer size parameter (bufsize) as well, because tcp_probe happily ignores packets once your log buffer is filled.


1 thought on “tcp_probe no workey?

  1. Eduardo Granados

    Hello, thank you for this post, it’s really helpful. Maybe you may help me with this problem i’m having. Originally my computer’s kernel did not have tcp_probe, i just checked it as module in menuconfig and compiled kernel.
    I call “modprobe tcp_probe [port=]” and seems to be running fine, but when i try to “cat /proc/net/tcpprobe > logfile.out” (doing some traffic generated with iperf), the log file is empty.

    I don’t really know what else to do.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s