3 ms·
Can someone explain how this differs from tcpdump and what advantages/disadvantages this new capability has?
by chrissnell 9y ago
Can someone explain how this differs from tcpdump and what advantages/disadvantages this new capability has?
- brendangregg 9y agotcpdump shows on-the-wire packet details only, and works by instrumenting all send/receive events. These tracepoints can expose a lot more information: kernel state (including congestion control metrics), process IDs, application stacks, etc, and do so with much lower overhead by instrumenting lower-frequency events only. This makes it much more suitable for production use. We'll be able to collect TCP session information 24x7 with negligible overhead, whereas tcpdump/libpcap would be too expensive in our environment (Netflix).