How to Trace TCP Socket TCP_INFO tcpi_fackets Forward Acknowledgment in Linux Using eBPF

Forward Acknowledgment (FACK) algorithm logic allows the Linux TCP stack to calculate outstanding flight sizes during loss recovery by tracking the highest sequence number acknowledged across SACK blocks. The kernel struct tcp_info records tcpi_fackets, tracking the number of segments between the cumulative ACK and the highest SACKed segment. Tracing this value with eBPF gives real-time visibility into loss recovery estimation accuracy.

Understanding Forward Acknowledgment Sizing

When a selective loss episode occurs, the gap between cumulative ACK and the highest sequence block indicates the span of outstanding unacknowledged flight. tcpi_fackets reflects this forward span, allowing the kernel to initiate prompt retransmissions before standard timeout intervals elapse.

eBPF BCC Program for Forward Acknowledgment Tracing

The following BCC Python script attaches to tcp_fastretrans_alert to log forward acknowledgment spans during loss episodes:

from bcc import BPF

bpf_source = """
#include <net/sock.h>
#include <linux/tcp.h>

struct fack_event_t {
    u32 pid;
    u16 sport;
    u16 dport;
    u32 fackets;
};

BPF_PERF_OUTPUT(fack_events);

int trace_fack(struct pt_regs *ctx, struct sock *sk) {
    if (sk->sk_family != AF_INET)
        return 0;

    struct tcp_sock *tp = tcp_sk(sk);
    struct fack_event_t evt = {};

    evt.pid = bpf_get_current_pid_tgid() >> 32;
    evt.sport = sk->sk_num;
    evt.dport = bpf_ntohs(sk->sk_dport);
    evt.fackets = tp->fackets_out;

    fack_events.perf_submit(ctx, &evt, sizeof(evt));
    return 0;
}
"""

b = BPF(text=bpf_source)
b.attach_kprobe(event="tcp_fastretrans_alert", fn_name="trace_fack")

def print_fack(cpu, data, size):
    e = b["fack_events"].event(data)
    print(f"FACK ALERT: Port {e.sport} -> {e.dport} | FACK Out: {e.fackets} segs")

b["fack_events"].open_perf_buffer(print_fack)
print("Listening for TCP forward acknowledgment events... Press Ctrl+C to terminate.")
while True:
    b.perf_buffer_poll()

Operational Diagnosis and Network Tuning

Run the script under root privileges:

sudo python3 trace_fack.py

High FACK spans confirm that the connection is aggressively probing loss holes without stalling on conservative retransmission timeouts.