How to Trace TCP Socket TCP_INFO tcpi_data_segs_in Rate in Linux Using eBPF

Monitoring ingress data velocity across high-throughput Linux network stacks requires visibility into socket-level segmentation metrics. While raw packet counters report total Ethernet frames, the kernel struct tcp_info maintains tcpi_data_segs_in, counting only inbound segments carrying non-empty data payloads. Tracing this value with eBPF unlocks granular insight into application protocol ingestion rates.

Distinguishing Payload Segments from Transport ACKs

Standard transport diagnostics often confound pure acknowledgment packets with active data ingestion. tcpi_data_segs_in increments solely when an incoming segment contains TCP payload data, providing an accurate, noise-free representation of genuine application workload volume.

eBPF BCC Program for Segment Delta Tracking

The following script attaches to tcp_rcv_established to log inbound payload segments across active sockets:

from bcc import BPF
import time

bpf_source = """
#include <net/sock.h>
#include <linux/tcp.h>

struct seg_metric_t {
    u32 pid;
    u16 sport;
    u16 dport;
    u32 segs_in;
};

BPF_PERF_OUTPUT(seg_events);

int trace_rx_segs(struct pt_regs *ctx, struct sock *sk) {
    if (sk->sk_family != AF_INET)
        return 0;

    struct tcp_sock *tp = tcp_sk(sk);
    struct seg_metric_t data = {};

    data.pid = bpf_get_current_pid_tgid() >> 32;
    data.sport = sk->sk_num;
    data.dport = bpf_ntohs(sk->sk_dport);
    data.segs_in = tp->data_segs_in;

    seg_events.perf_submit(ctx, &data, sizeof(data));
    return 0;
}
"""

b = BPF(text=bpf_source)
b.attach_kprobe(event="tcp_rcv_established", fn_name="trace_rx_segs")

def print_metrics(cpu, data, size):
    evt = b["seg_events"].event(data)
    print(f"PID {evt.pid:<6} | Port {evt.sport} -> {evt.dport} | Data Segs In: {evt.segs_in}")

b["seg_events"].open_perf_buffer(print_metrics)
print("Listening for TCP ingress segments... Press Ctrl+C to exit.")
while True:
    b.perf_buffer_poll()

Operational Verification and Ingress Tuning

Execute the monitoring script with elevated privileges:

sudo python3 trace_segs_in.py

If inbound payload rates reveal irregular burst patterns, evaluate whether Large Receive Offload (LRO) or Generic Receive Offload (GRO) settings on the physical interface are coalescing packets efficiently via ethtool -k <interface>.