How to Trace TCP Socket TCP_INFO tcpi_snd_wnd Clamping in Linux Using eBPF

TCP send window clamping occurs when a remote client fails to drain its local socket buffer, causing the advertised receive window to collapse towards zero. The kernel struct tcp_info records tcpi_snd_wnd, reflecting the maximum byte sequence the sender is permitted to transmit before waiting for an ACK. Tracing send window clamping with eBPF gives real-time visibility into downstream consumer bottlenecks.

Identifying Window Clamping vs Network Congestion

While congestion drops trigger packet retransmissions and shrink snd_cwnd, receive window clamping leaves snd_cwnd unaffected while freezing transmission due to peer exhaustion. Isolating tcpi_snd_wnd prevents infrastructure engineers from incorrectly troubleshooting network latency when client processes freeze.

eBPF BCC Script for Window Clamping Alerts

The following BCC Python script attaches to tcp_ack to flag sockets where the advertised send window drops below critical thresholds:

from bcc import BPF

bpf_source = """
#include <net/sock.h>
#include <linux/tcp.h>

struct clamp_event_t {
    u32 pid;
    u16 sport;
    u16 dport;
    u32 snd_wnd;
};

BPF_PERF_OUTPUT(clamp_events);

int trace_wnd_clamp(struct pt_regs *ctx, struct sock *sk) {
    if (sk->sk_family != AF_INET)
        return 0;

    struct tcp_sock *tp = tcp_sk(sk);
    if (tp->snd_wnd < 2048) { // Alert on tight window clamping
        struct clamp_event_t evt = {};
        evt.pid = bpf_get_current_pid_tgid() >> 32;
        evt.sport = sk->sk_num;
        evt.dport = bpf_ntohs(sk->sk_dport);
        evt.snd_wnd = tp->snd_wnd;
        clamp_events.perf_submit(ctx, &evt, sizeof(evt));
    }
    return 0;
}
"""

b = BPF(text=bpf_source)
b.attach_kprobe(event="tcp_ack", fn_name="trace_wnd_clamp")

def print_clamp(cpu, data, size):
    e = b["clamp_events"].event(data)
    print(f"ALERT: Port {e.sport} -> {e.dport} (PID {e.pid}) clamped to {e.snd_wnd} bytes!")

b["clamp_events"].open_perf_buffer(print_clamp)
print("Monitoring for TCP send window clamping... Press Ctrl+C to terminate.")
while True:
    b.perf_buffer_poll()

Operational Diagnosis and Network Tuning

Execute the monitoring probe on the host machine:

sudo python3 trace_clamp.py

When alerts trigger frequently, investigate downstream client process CPU throttling, garbage collection pauses, or undersized client receive buffers (SO_RCVBUF).