---
title: top_tcp
sidebar_position: 0
---

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

# top_tcp

The top_tcp gadget reports tcp send receive activity by connection.

## Requirements

- Minimum Kernel Version : *5.4

*This is the minimal kernel version we have tried for this Gadget, however it's possible that it works with earlier versions.

## Getting started

Running the gadget:

<Tabs groupId="env">
    <TabItem value="kubectl-gadget" label="kubectl gadget">
        ```bash
        $ kubectl gadget run ghcr.io/inspektor-gadget/gadget/top_tcp:%IG_TAG% [flags]
        ```
    </TabItem>

    <TabItem value="ig" label="ig">
        ```bash
        $ sudo ig run ghcr.io/inspektor-gadget/gadget/top_tcp:%IG_TAG% [flags]
        ```
    </TabItem>
</Tabs>

## Flags

### `--family`

Trace traffic from the specified IPv family. Can be either 4 or 6. Specifying -1 equals to no filtering

Default value: "-1"

### `--pid`

Show only events generated by process with this PID

Default value: "0"

## Guide

<Tabs groupId="env">
    <TabItem value="kubectl-gadget" label="kubectl gadget">
        First, we need to create one pod for us to play with:

        ```bash
        kubectl run mypod --image busybox:%IG_TAG% sleep inf
        ```
    </TabItem>

    <TabItem value="ig" label="ig">
        First, we need to create a container for us to play with:

        ```bash
        docker run -d --name mycontainer busybox:%IG_TAG% sleep inf
        ```
    </TabItem>
</Tabs>

You can now use the gadget, but output will be empty:

<Tabs groupId="env">
    <TabItem value="kubectl-gadget" label="kubectl gadget">
        ```bash
        $ kubectl gadget run top_tcp:%IG_TAG% --podname mypod
        K8S.NODE     K8S.NAMESPACE          K8S.PODNAME            K8S.CONTAINERNAME               PID SRC                                 DST                                COMM          SENT          RECEIVED
        ```
    </TabItem>

    <TabItem value="ig" label="ig">
        ```bash
        $ sudo ig run top_tcp:%IG_TAG% --containername mycontainer
        RUNTIME.CONTAINERNAME                 PID SRC                                 DST                                COMM          SENT          RECEIVED
        ```
    </TabItem>
</Tabs>

Indeed, it is waiting for TCP connection to occur.
So, open *another terminal* and keep and eye on the first one, `exec` the container and use `wget`:

<Tabs groupId="env">
    <TabItem value="kubectl-gadget" label="kubectl gadget">
        ```bash
        $ kubectl exec -ti mypod -- wget inspektor-gadget.io
        Connecting to inspektor-gadget.io (188.114.96.0:80)
        Connecting to inspektor-gadget.io (188.114.96.0:443)
        wget: note: TLS certificate validation not implemented
        saving to 'index.html'
        index.html           100% |**********************************************************************************************************| 37851  0:00:00 ETA
        'index.html' saved
        ```
    </TabItem>

    <TabItem value="ig" label="ig">
        ```bash
        $ docker exec mycontainer wget inspektor-gadget.io
        Connecting to inspektor-gadget.io (188.114.97.7:80)
        Connecting to inspektor-gadget.io (188.114.96.7:443)
        wget: note: TLS certificate validation not implemented
        saving to 'index.html'
        index.html           100% |********************************| 37851  0:00:00 ETA
        'index.html' saved
        ```
    </TabItem>
</Tabs>

On *the first terminal*, you should see:

<Tabs groupId="env">
    <TabItem value="kubectl-gadget" label="kubectl gadget">
        ```bash
        K8S.NODE     K8S.NAMESPACE          K8S.PODNAME            K8S.CONTAINERNAME               PID SRC                                 DST                                COMM          SENT          RECEIVED
        aks-agentpo… default                mypod                  mypod                       3602459 p/default/mypod:57076               188.114.97.7:443                   wget           320             42652
        aks-agentpo… default                mypod                  mypod                       3602452 p/default/mypod:49538               188.114.96.7:80                    wget             0               582
        ```
    </TabItem>

    <TabItem value="ig" label="ig">
        ```bash
        RUNTIME.CONTAINERNAME                 PID SRC                                 DST                                COMM          SENT          RECEIVED
        mycontainer                         79480 172.17.0.4:42522                    188.114.97.7:80                    wget          82            588
        mycontainer                         79499 172.17.0.4:54254                    188.114.96.7:443                   wget          320           42655
        ```
    </TabItem>
</Tabs>

These lines correspond to the TCP connection initiated by `wget`.

Finally, clean the system:

<Tabs groupId="env">
    <TabItem value="kubectl-gadget" label="kubectl gadget">
        ```bash
        kubectl delete pod mypod
        ```
    </TabItem>

    <TabItem value="ig" label="ig">
        ```bash
        docker rm -f mycontainer
        ```
    </TabItem>
</Tabs>
