How to Trace TCP Socket TCP_INFO tcpi_retrans_synack TCP Fast Open Passive Handshake Drops in Linux Using eBPF

TCP Fast Open (TFO, RFC 7413) optimizes web application latency by permitting data payload transmission within the initial SYN packet. On passive (server-side) Linux sockets, the kernel authenticates client cookies before passing payload data directly to the application layer. However, if the client supplies an expired cookie, or if middleboxes discard data-bearing SYN packets, the kernel must fall back to a traditional three-way handshake, retransmitting SYN-ACK packets and incrementing tcpi_retrans_synack. Extended Berkeley Packet Filters (eBPF) enable non-intrusive kernel tracing to isolate TFO handshake degradation in real time.

Linux Kernel TFO Passive Handshake Architecture

When a server socket accepts inbound connections with TFO enabled via setsockopt(..., TCP_FASTOPEN, ...), the kernel processes incoming SYN packets in tcp_rcv_synsent_state_process() and tcp_fastopen_check(). If the client cookie is valid, the kernel ACKs both the SYN and the data payload immediately in the SYN-ACK segment.

If network middleboxes strip the data payload or drop the fast-open handshake, or if client cookie validation fails, the kernel aborts the fast data path and falls back to standard retransmissions. These stalls escalate socket retransmit counters visible in struct tcp_info field tcpi_retrans_synack. Utilizing eBPF probes attached to kernel fast-open functions provides granular diagnostics of cookie rejection rates and retransmission stalls.

Developing the bpftrace Monitoring Script

Author a targeted bpftrace probe to trace TCP Fast Open cookie validation events and correlate them with SYN-ACK retransmits:

#!/usr/bin/env bpftrace
/* trace_tfo_passive_drops.bt - Trace Linux TFO passive handshake stalls */

#include <net/sock.h>
#include <linux/tcp.h>

kprobe:tcp_fastopen_check
{
    $sk = (struct sock *)arg0;
    $inet = (struct inet_sock *)$sk;
    $saddr = ntop($sk->__sk_common.skc_rcv_saddr);
    $daddr = ntop($sk->__sk_common.skc_daddr);
    $dport = $sk->__sk_common.skc_dport;
    $dport = ($dport >> 8) | (($dport & 0xff) << 8);

    @tfo_checks[$saddr, $daddr, $dport] = count();
}

kprobe:tcp_fastopen_cookie_gen
{
    @tfo_cookies_generated = count();
}

tracepoint:tcp:tcp_retransmit_synack
{
    $sk = (struct sock *)args->skaddr;
    $saddr = ntop(args->saddr);
    $daddr = ntop(args->daddr);

    printf("SYN-ACK Retransmit: %s -> %s (TFO Fallback or Handshake Loss)
",
           $saddr, $daddr);
    @tfo_retransmits[$saddr, $daddr] = count();
}

interval:s:5
{
    time("%H:%M:%S ");
    printf("--- TCP Fast Open & SYN-ACK Activity (5s) ---
");
    print(@tfo_checks);
    print(@tfo_cookies_generated);
    print(@tfo_retransmits);
    clear(@tfo_checks);
    clear(@tfo_retransmits);
}

Running the Trace on Production Linux Systems

Execute the probe with root privileges on the target server:

# Verify BPF tracing packages
sudo apt-get update && sudo apt-get install -y bpftrace linux-headers-$(uname -r)

# Execute the diagnostic probe
sudo bpftrace trace_tfo_passive_drops.bt

Monitor the live output during high inbound traffic. A discrepancy between high @tfo_checks and rising @tfo_retransmits indicates middlebox interference or cookie expiry on the inbound network path.

Kernel Optimization and Parameter Tuning

Verify that Linux kernel TFO flags are properly configured to support both client and server modes:

# Check current TCP Fast Open setting (3 enables both client and server)
sysctl net.ipv4.tcp_fastopen

# Configure kernel parameter to fully enable TFO
sudo sysctl -w net.ipv4.tcp_fastopen=3

# Persist configuration in sysctl.d
echo "net.ipv4.tcp_fastopen = 3" | sudo tee /etc/sysctl.d/99-tcp-fastopen.conf
sudo sysctl --system

Pairing eBPF kernel inspection with proper sysctl parameterisation ensures low-latency TFO handshakes while rapidly identifying packet-loss bottlenecks.