How to Trace TCP Socket TCP_INFO tcpi_bytes_received in Linux Using eBPF

In high-throughput Linux network infrastructure, measuring raw packet counts or socket buffer sizes only provides an approximation of real data delivery. Packets can be duplicated, dropped, or retransmitted multiple times without progressing the receiver’s byte stream. To measure true, confirmed data throughput, the Linux kernel maintains the tcpi_bytes_received counter inside struct tcp_info, recording the exact cumulative number of data bytes confirmed as delivered to the peer application via acknowledgements.

Tracing tcpi_bytes_received using extended Berkeley Packet Filter (eBPF) and bpftrace allows systems engineers to calculate exact byte-level transfer speeds and audit true goodput across production nodes non-invasively.

Understanding tcpi_bytes_received in Kernel Space

Defined in include/uapi/linux/tcp.h, the Linux kernel tracks cumulative byte counters:

struct tcp_info {
    /* ... state fields ... */
    __u64   tcpi_bytes_acked;    /* RFC4898 tcpEStatsAppBytesAcked */
    __u64   tcpi_bytes_received; /* RFC4898 tcpEStatsAppBytesRcvd */
    __u32   tcpi_segs_out;
    __u32   tcpi_segs_in;
};

Unlike raw sequence numbers (which wrap around 32-bit limits), tcpi_bytes_received is a 64-bit monotonically increasing counter. By sampling tcpi_bytes_received across time intervals, engineers calculate true application goodput:

Goodput (Mbps) = ((bytes_received_t2 - bytes_received_t1) * 8) / (delta_t_seconds * 1,000,000)

Authoring the bpftrace Inbound Goodput Probe

The following bpftrace script monitors tcp_close() to generate delivery audits upon connection termination:

#!/usr/bin/env bpftrace

#include <net/sock.h>
#include <linux/tcp.h>

kprobe:tcp_close
{
    $sk = (struct sock *)arg0;
    $inet = (struct inet_sock *)$sk;
    $tp = (struct tcp_sock *)$sk;

    $daddr = ntop($inet->inet_daddr);
    $saddr = ntop($inet->inet_saddr);
    $lport = bswap($inet->inet_sport);
    $bytes_in = $tp->bytes_received;

    if ($bytes_in > 100000) {
        time("%H:%M:%S ");
        printf("INGESTION AUDIT | Port: %d <- Peer: %s | Delivered In: %d KB\n",
            $lport, $daddr, $bytes_in / 1024);
    }
}

Running the Trace and Diagnosing Ingestion Speeds

Execute the bpftrace script on your Linux storage worker or CDN node:

sudo bpftrace trace_bytes_received.bt

When connections terminate, bpftrace outputs confirmed delivery metrics:

09:22:15 INGESTION AUDIT | Port: 9000 <- Peer: 10.0.1.25 | Delivered In: 64200 KB
09:22:30 INGESTION AUDIT | Port: 9000 <- Peer: 192.168.1.18 | Delivered In: 18400 KB

This telemetric verification provides definitive evidence of application-layer bytes successfully read from kernel buffers.

Production Applications and Monitoring

Tracking tcpi_bytes_received via eBPF helps systems teams:

1. Audit true customer data transfer volume for accurate billing and SLA reporting.
2. Identify clients experiencing degraded goodput despite high raw packet transmission counts.
3. Validate that TCP BBR pacing achieves target transmission velocity without generating retransmission storms.