It's borderline. While this is a hack, ftrace and kprobes are built-in to the kernel, and are immediately available on all our production Ubuntu and CentOS inst

It's borderline. While this is a hack, ftrace and kprobes are built-in to the kernel, and are immediately available on all our production Ubuntu and CentOS instances. And /proc/net/tcp is usually still valid for long-running sessions with retransmits. I'll install and use SystemTap when there's no other practical way. I wrote some other TCP scripts using ftrace, and the caching of /proc/net/tcp approach didn't cut it (due to short-lived sessions, which were too often missing by the time /proc/net/tcp could be read), and I'll need to rewrite them in SystemTap (or something else). Those make much better examples of why SystemTap. I'll publish them when I get a chance.