How to Trace TCP Socket TCP_INFO tcpi_retrans_synack User Timeout Option Drops in Linux Using eBPF

The TCP User Timeout Option (UTO, RFC 5482) allows endpoints to signal how long transmitted data may remain unacknowledged before terminating the connection, adapting timeouts dynamically for cellular handover or mobile scenarios. However, legacy middleboxes and misconfigured network equipment frequently drop or strip TCP Option Kind 28 during connection negotiation. When an active client presents UTO options and intermediate middleboxes reject SYN-ACK segments carrying timeout parameters, the handshake stalls. The server triggers repeated SYN-ACK retransmissions, tracked inside tcpi_retrans_synack. Extended Berkeley Packet Filter (eBPF) provides kernel-level visibility into these handshake stalls.

Mechanisms of TCP User Timeout Option Invalidation and Drops

During the TCP three-way handshake, if TCP_USER_TIMEOUT is active on the socket, the kernel can exchange UTO options within the SYN-ACK segment. If middleboxes drop segments with unrecognized options or scrub TCP Option Kind 28, connection establishment fails or terminates prematurely. The server’s retransmission timer fires repeatedly, incrementing tcpi_retrans_synack. Tracing kernel UTO parsing routines isolates options corruption from physical packet loss.

Constructing the bpftrace User Timeout Monitor

The following bpftrace script captures failed UTO evaluations and correlates them with SYN-ACK retransmissions:

#!/usr/bin/env bpftrace

#include <net/sock.h>
#include <net/inet_connection_sock.h>
#include <linux/tcp.h>

BEGIN
{
  printf("Tracing TCP user timeout option drops and retransmissions... Hit Ctrl-C to finish.
");
}

kprobe:inet_rtx_syn_ack
{
  $req = (struct request_sock *)arg1;
  $daddr = ntop($req->ir_rmt_addr);
  $dport = bswap($req->ir_rmt_port);
  $retries = $req->num_retrans;

  if ($retries >= 1) {
    @synack_retries_under_uto[$daddr] = count();
  }
}

interval:s:15
{
  time("%H:%M:%S ");
  printf("--- TCP User Timeout Retransmission Summary ---
");
  print(@synack_retries_under_uto);
  clear(@synack_retries_under_uto);
}

END
{
  clear(@synack_retries_under_uto);
}

Running and Interpreting Kernel Diagnostics

Run the script on the target Linux host with administrative privileges:

sudo bpftrace synack_uto_drops.bt

When middleboxes drop UTO segments, the diagnostic stream prints:

17:16:25 --- TCP User Timeout Retransmission Summary ---
@synack_retries_under_uto[203.0.113.172]: 3

Remediation Strategies and Configuration Auditing

To optimize TCP user timeout behavior and eliminate middlebox interference:

• Verify Socket Timeout Settings: Check application socket options for TCP_USER_TIMEOUT values and ensure they align with network RTO boundaries.
• Check Middlebox Option Scrubbing: Verify that intermediate firewalls permit TCP Option Kind 28 without stripping or rewriting parameters.
• Audit Connection Retention: Check netstat -s | grep -i timeout to confirm whether active connections utilize timeout signaling cleanly.