How to Trace TCP Retransmissions and Duplicate ACKs in Linux Using tcpretrans

TCP packet retransmissions are one of the most reliable indicators of network congestion, bufferbloat, or silent packet drops in Linux systems. Standard diagnostic tools such as netstat or ss report aggregate retransmission counters, but they fail to capture the transient spikes, specific socket endpoints, or duplicate acknowledgement patterns behind individual network stalls. The tcpretrans utility, part of the BPF Compiler Collection (BCC), resolves this by dynamically tracing kernel TCP retransmission events in real time with near-zero overhead.

How TCP Retransmissions and Duplicate ACKs Occur in Linux

In standard TCP operation, when a sender transmits segments, the receiver returns cumulative acknowledgements (ACKs) confirming arrival. If an expected segment is lost or delayed, the receiver generates duplicate ACKs for the last successfully received in-order byte sequence.

Depending on kernel socket configuration and TCP congestion algorithms (such as Cubic or BBR), the Linux kernel initiates recovery using one of two primary mechanisms:

• Fast Retransmit: Triggered when three duplicate ACKs arrive at the sender, immediately resending the missing segment without waiting for the retransmit timer to expire.
• Retransmission Timeout (RTO): Occurs when packet drops or severe queuing prevent duplicate ACKs from reaching the sender, forcing the kernel to wait for an exponential backoff timer before resending.

Tracing these kernel events directly using extended Berkeley Packet Filters (eBPF) allows engineers to pinpoint whether connection drops stem from local interface saturation, router queue overflows, or remote endpoint unresponsiveness.

Installing the BCC Tools Suite

The tcpretrans tool hooks into kernel probe points (such as tcp_retransmit_skb) without requiring kernel modifications or intrusive packet captures.

To install the BCC utilities on Debian and Ubuntu systems:

sudo apt update
sudo apt install bpfcc-tools linux-headers-$(uname -r)

On Red Hat Enterprise Linux, Rocky Linux, or Fedora:

sudo dnf install bcc-tools kernel-devel-$(uname -r)

The executable is typically installed under /usr/sbin/tcpretrans-bpfcc or /usr/share/bcc/tools/tcpretrans.

Tracing Active TCP Retransmissions in Real Time

Running tcpretrans with default parameters prints a log line whenever the kernel retransmits a TCP segment:

sudo tcpretrans-bpfcc

The default output displays several diagnostic columns:

• TIME: Timestamp of the retransmitted segment.
• PID: Process ID responsible for the socket.
• IP: IP version (IPv4 or IPv6).
• LADDR:LPORT: Local address and source port.
• RADDR:RPORT: Remote peer address and destination port.
• STATE: TCP connection state (e.g., ESTABLISHED, SYN_SENT).

Analysing TCP State and Retransmit Latency

To understand the severity of packet loss and measure recovery delays, pass the -l flag to capture loss recovery information and round-trip times:

sudo tcpretrans-bpfcc -l

This displays the socket’s smoothed round-trip time (SRTT) alongside retransmission events, making it straightforward to distinguish high-latency wide-area link drops from local network interface drops.

Filtering Retransmissions by Specific Network Parameters

In high-throughput environments, filtering output prevents terminal noise and isolates problematic microservices.

Filtering by Process ID

To isolate network retransmissions originating from a specific daemon (e.g., an Nginx or PostgreSQL instance):

sudo tcpretrans-bpfcc -p 18422

Filtering Out SYN and FIN Handshake Drops

Often, transient port scans or failed connection attempts generate noise during initial handshakes. To focus purely on established data flows, use the -s flag to evaluate connection states:

sudo tcpretrans-bpfcc -c

The -c flag aggregates retransmissions into a summary table by connection tuple, displaying total retransmit counts per remote IP rather than streaming individual packet lines.

Correlating Retransmissions with Interface Queue Drops

If tcpretrans reveals bursts of retransmissions toward local subnet hosts, verify whether local network interface driver queues are dropping packets before transmission:

ethtool -S eth0 | grep -E "drop|miss|err"

By pairing tcpretrans with interface metrics, network administrators can rapidly verify whether degraded throughput originates from internal switch contention, faulty transceivers, or external transit provider degradation.