TRPT(8) System Manager's Manual TRPT(8)

trpt — transliterate protocol trace

trpt [-afjst] [-M core] [-N system] [-p hex-address]

trpt interrogates the buffer of TCP trace records created when a socket is marked for “debugging” (see setsockopt(2)), and prints a readable description of these records. When no options are supplied, trpt prints all the trace records found in the system grouped according to TCP connection protocol control block (PCB).

The options are as follows:

In addition to the normal output, print the values of the source and destination addresses for each packet recorded.
Follow the trace as it occurs, waiting a short time for additional records each time the end of the log is reached.
Just give a list of the protocol control block addresses for which there are trace records.
core
Extract values associated with the name list from core instead of the running kernel.
system
Extract the name list from system instead of the running kernel.
hex-address
Show only trace records associated with the protocol control block at the given address hex-address.
In addition to the normal output, print a detailed description of the packet sequencing information.
In addition to the normal output, print the values for all timers at each point in the trace.

The recommended use of trpt is as follows. Isolate the problem and enable debugging on the socket(s) involved in the connection. Find the address of the protocol control blocks associated with the sockets using the -A option to netstat(1). Then run trpt with the -p option, supplying the associated protocol control block addresses. The -f option can be used to follow the trace log once the trace is located. If there are many sockets using the debugging option, the -j option may be useful in checking to see if any trace records are present for the socket in question.

trpt requires the ability to open /dev/kmem which may be restricted based upon the value of the kern.allowkmem sysctl(8).

When the system image doesn't contain the proper symbols to find the trace buffer; others which should be self explanatory.

netstat(1), setsockopt(2)

The trpt command appeared in 4.2BSD.

Should also print the data for each input or output, but this is not saved in the trace record.

The output format is inscrutable and should be described here.

September 25, 2016 Debian