How to Trace TCP Socket TCP_INFO tcpi_data_segs_out Rate in Linux Using eBPF

Analysing egress data transmission velocity across production Linux clusters requires precise metrics that differentiate pure network protocol acknowledgments from real application payloads. The Linux kernel struct tcp_info records tcpi_data_segs_out, counting strictly outbound segments containing user data. Tracing this parameter with eBPF exposes outbound application throughput without incurring significant overhead.

Significance of Egress Data Segmentation

Transport layer counters typically aggregate duplicate ACKs, window probes, and pure keepalive packets alongside active data transfers. By isolating tcpi_data_segs_out, network reliability engineers can measure exactly how many genuine data segments the Linux network stack dispatches per socket connection.

Implementing the eBPF Monitoring Probe

Deploy the following BCC Python script to intercept tcp_write_xmit events and monitor data segment departure counts:

from bcc import BPF

bpf_code = """
#include <net/sock.h>
#include <linux/tcp.h>

struct egress_event_t {
    u32 pid;
    u16 sport;
    u16 dport;
    u32 segs_out;
};

BPF_PERF_OUTPUT(egress_events);

int trace_tx(struct pt_regs *ctx, struct sock *sk) {
    if (sk->sk_family != AF_INET)
        return 0;

    struct tcp_sock *tp = tcp_sk(sk);
    struct egress_event_t evt = {};

    evt.pid = bpf_get_current_pid_tgid() >> 32;
    evt.sport = sk->sk_num;
    evt.dport = bpf_ntohs(sk->sk_dport);
    evt.segs_out = tp->data_segs_out;

    egress_events.perf_submit(ctx, &evt, sizeof(evt));
    return 0;
}
"""

b = BPF(text=bpf_code)
b.attach_kprobe(event="tcp_write_xmit", fn_name="trace_tx")

def print_egress(cpu, data, size):
    e = b["egress_events"].event(data)
    print(f"PID {e.pid:<6} | Port {e.sport} -> {e.dport} | Data Segs Out: {e.segs_out}")

b["egress_events"].open_perf_buffer(print_egress)
print("Tracing tcpi_data_segs_out... Press Ctrl+C to terminate.")
while True:
    b.perf_buffer_poll()

Operational Insights and Network Optimization

Run the script under root privileges:

sudo python3 trace_segs_out.py

When an application exhibits erratic or declining outbound segment increments, check the TCP Congestion Window (snd_cwnd) and verify whether TCP Segmentation Offload (TSO) is active on the network card using ethtool -k <interface>.