How to Trace TCP Socket TCP_INFO tcpi_min_rtt Sample Latency in Linux Using eBPF

Tracking the minimum observed round-trip time (min_rtt) over a connection’s lifespan is essential for establishing clean baseline physical latency before queueing delay occurs. The Linux kernel struct tcp_info records tcpi_min_rtt, tracking the lowest sampled round-trip latency. Tracing this value with eBPF gives network engineers direct visibility into physical routing path alterations and datacenter transit stability.

Significance of Baseline Minimum RTT

While average smoothed RTT (srtt) fluctuates wildly under queue buildup, min_rtt acts as an anchor representing true propagation and serialization delay. An upward step change in min_rtt signals underlying physical rerouting (such as BGP failover or optical path switching), whereas a widening gap between srtt and min_rtt diagnoses acute bufferbloat.

eBPF BCC Program for Baseline Latency Monitoring

The following BCC Python script attaches to tcp_update_rtt to log minimum RTT observations in microseconds:

from bcc import BPF

bpf_source = """
#include <net/sock.h>
#include <linux/tcp.h>

struct rtt_event_t {
    u32 pid;
    u16 sport;
    u16 dport;
    u32 min_rtt;
    u32 srtt;
};

BPF_PERF_OUTPUT(rtt_events);

int trace_rtt(struct pt_regs *ctx, struct sock *sk) {
    if (sk->sk_family != AF_INET)
        return 0;

    struct tcp_sock *tp = tcp_sk(sk);
    struct rtt_event_t evt = {};

    evt.pid = bpf_get_current_pid_tgid() >> 32;
    evt.sport = sk->sk_num;
    evt.dport = bpf_ntohs(sk->sk_dport);
    evt.min_rtt = tp->rtt_min[0].rtt;
    evt.srtt = tp->srtt_us >> 3;

    rtt_events.perf_submit(ctx, &evt, sizeof(evt));
    return 0;
}
"""

b = BPF(text=bpf_source)
b.attach_kprobe(event="tcp_update_rtt_min", fn_name="trace_rtt")

def print_rtt(cpu, data, size):
    e = b["rtt_events"].event(data)
    print(f"PID {e.pid:<6} | Port {e.sport} -> {e.dport} | min_rtt: {e.min_rtt} us | srtt: {e.srtt} us")

b["rtt_events"].open_perf_buffer(print_rtt)
print("Listening for tcpi_min_rtt baseline updates... Press Ctrl+C to terminate.")
while True:
    b.perf_buffer_poll()

Operational Diagnosis and Network Tuning

Execute the monitoring script under superuser privileges:

sudo python3 trace_min_rtt.py

When srtt is more than 3x higher than min_rtt, intermediate network devices are buffering excess packets; investigate Active Queue Management (AQM) options like CoDel or fq_codel on upstream egress routers.