How to Trace TCP Socket TCP_INFO tcpi_data_segs_out in Linux Using eBPF

In high-throughput Linux network infrastructure, monitoring outbound TCP efficiency is critical for capacity planning, egress bandwidth optimization, and latency minimization. While total transmitted packets (tcpi_segs_out) include pure acknowledgements, window probes, and retransmission frames, isolating packets that carry actual application payload data provides the true measure of productive transport throughput. The Linux kernel maintains this metric in struct tcp_info as tcpi_data_segs_out.

Using extended Berkeley Packet Filter (eBPF) and bpftrace, systems engineers can trace tcpi_data_segs_out non-invasively at the kernel level, auditing outbound data efficiency and identifying micro-packet fragmentation issues in real time.

Understanding tcpi_data_segs_out in Kernel Space

Defined in include/uapi/linux/tcp.h, modern Linux kernels maintain granular egress counters:

struct tcp_info {
    /* ... state fields ... */
    __u32   tcpi_segs_out;       /* Total outbound segments sent */
    __u32   tcpi_data_segs_out;  /* Outbound segments containing payload */
    __u32   tcpi_segs_in;        /* Total inbound segments received */
    __u32   tcpi_data_segs_in;   /* Inbound segments containing payload */
};

By comparing tcpi_data_segs_out against tcpi_segs_out, engineers calculate the Outbound Transmission Efficiency Ratio (OTER):

Outbound Transmission Efficiency Ratio = (tcpi_data_segs_out / tcpi_segs_out) * 100%

A low OTER on a high-bandwidth server indicates excessive pure ACK traffic, window updates, or unbundled small writes.

Authoring the bpftrace Outbound Segment Probe

The following bpftrace script probes tcp_close() to generate an egress audit as connections terminate:

#!/usr/bin/env bpftrace

#include <net/sock.h>
#include <linux/tcp.h>

kprobe:tcp_close
{
    $sk = (struct sock *)arg0;
    $inet = (struct inet_sock *)$sk;
    $tp = (struct tcp_sock *)$sk;

    $daddr = ntop($inet->inet_daddr);
    $saddr = ntop($inet->inet_saddr);
    $dport = bswap($inet->inet_dport);
    $segs_out = $tp->segs_out;
    $data_segs_out = $tp->data_segs_out;

    if ($segs_out > 50) {
        $efficiency = $segs_out > 0 ? ($data_segs_out * 100) / $segs_out : 0;
        time("%H:%M:%S ");
        printf("CLOSED %s -> %s:%d | Total Out: %d | Data Out: %d | Egress Ratio: %d%%\n",
            $saddr, $daddr, $dport, $segs_out, $data_segs_out, $efficiency);
    }
}

Running the Trace and Diagnosing Egress Patterns

Run the script on your Linux database server or edge gateway:

sudo bpftrace trace_data_segs_out.bt

The output streams active socket telemetry in real time:

01:22:10 CLOSED 10.0.1.15 -> 10.0.9.44:5432 | Total Out: 64000 | Data Out: 61500 | Egress Ratio: 96%
01:22:25 CLOSED 10.0.1.15 -> 172.16.5.20:80 | Total Out: 12000 | Data Out: 1800 | Egress Ratio: 15%

The second line indicates an endpoint sending excessive empty acknowledgements or experiencing heavy socket retransmissions, pointing to suboptimal buffer settings.

Production Applications and Optimization

Monitoring tcpi_data_segs_out with eBPF enables systems teams to:

1. Verify that application write buffering and TCP_CORK are active on high-volume web servers.
2. Tune Generic Segmentation Offload (GSO) and TCP Segmentation Offload (TSO) on NICs to maximize segment coalescing.
3. Optimize cloud egress costs by reducing packet framing overhead.