How to Trace TCP Socket TCP_INFO tcpi_retrans_synack Multipath TCP Initial Handshake Drops in Linux Using eBPF

Multipath TCP (MPTCP, RFC 8684) allows a single TCP connection to aggregate bandwidth across multiple network interfaces, such as Wi-Fi and 5G cellular modems. During initial subflow establishment, MPTCP options (MP_CAPABLE, Kind 30) are exchanged within the SYN and SYN-ACK segments. However, legacy middleboxes and intrusion prevention systems frequently drop or strip TCP Option Kind 30. When a client advertises MP_CAPABLE and intermediate middleboxes reject SYN-ACK segments containing MPTCP parameters, the handshake stalls. The server triggers repeated SYN-ACK retransmissions, tracked inside tcpi_retrans_synack. Extended Berkeley Packet Filter (eBPF) provides kernel-level visibility into these handshake stalls.

Mechanisms of MPTCP Handshake Drops and Middlebox Interference

During MPTCP connection establishment, if net.mptcp.enabled = 1 is configured, the kernel attaches MP_CAPABLE options to the SYN-ACK segment. If intermediate middleboxes discard segments with unrecognized options or strip MPTCP tokens, subflow negotiation collapses to standard single-path TCP or connections drop completely. The server’s retransmission timer fires repeatedly, incrementing tcpi_retrans_synack. Tracing kernel MPTCP option parsing routines isolates middlebox option scrubbing from physical cable faults.

Constructing the bpftrace MPTCP Monitor

The following bpftrace script captures MPTCP handshake negotiation anomalies and correlates them with SYN-ACK retransmissions:

#!/usr/bin/env bpftrace

#include <net/sock.h>
#include <net/inet_connection_sock.h>
#include <linux/tcp.h>

BEGIN
{
  printf("Tracing MPTCP handshake drops and retransmissions... Hit Ctrl-C to finish.
");
}

kprobe:inet_rtx_syn_ack
{
  $req = (struct request_sock *)arg1;
  $daddr = ntop($req->ir_rmt_addr);
  $dport = bswap($req->ir_rmt_port);
  $retries = $req->num_retrans;

  if ($retries >= 1) {
    @synack_retries_under_mptcp[$daddr] = count();
  }
}

interval:s:15
{
  time("%H:%M:%S ");
  printf("--- MPTCP Retransmission Summary ---
");
  print(@synack_retries_under_mptcp);
  clear(@synack_retries_under_mptcp);
}

END
{
  clear(@synack_retries_under_mptcp);
}

Running and Interpreting Kernel Diagnostics

Run the script on the target Linux host with administrative privileges:

sudo bpftrace synack_mptcp_drops.bt

When middleboxes drop MPTCP segments, the diagnostic stream prints:

17:14:25 --- MPTCP Retransmission Summary ---
@synack_retries_under_mptcp[203.0.113.165]: 4

Remediation Strategies and Configuration Auditing

To optimize MPTCP handling behavior and eliminate middlebox interference:

• Verify MPTCP Kernel Setting: Ensure net.mptcp.enabled = 1 is active in /etc/sysctl.conf.
• Check Middlebox Option Scrubbing: Verify that intermediate firewalls permit TCP Option Kind 30 without stripping or rewriting parameters.
• Inspect Subflow Fallback: Check mptcp monitor to confirm whether active connections fall back smoothly to plain TCP upon negotiation timeout.