How to Trace TCP Socket TCP_INFO tcpi_min_rtt in Linux Using eBPF

Modern latency-sensitive networking systems—including edge routing meshes, Google BBR congestion control, and financial exchange proxies—rely on accurate estimation of the minimum Round-Trip Time (min_rtt). While standard smoothed RTT (srtt) includes variable queueing delays at intermediate hops, min_rtt represents the intrinsic physical propagation delay of the network path. In the Linux kernel, this value is maintained in tp->rtt_min and exported via struct tcp_info -> tcpi_min_rtt. Tracing minimum RTT updates using eBPF provides kernel-level visibility into network path changes and bufferbloat dynamics.

Mechanics of Linux Minimum RTT Tracking

The Linux kernel tracks minimum RTT using a min-filter window (typically 10 to 300 seconds) inside tcp_update_rtt_min(). When an ACK arrives containing an RTT sample:

1. The kernel updates tp->rtt_min[0] with the smallest RTT observed within the current time window.
2. If an RTT sample is smaller than the active minimum, it immediately replaces the baseline minimum RTT.
3. BBR uses this value to calculate the Bandwidth-Delay Product (BDP) ceiling: $ ext{BDP} = ext{BtlBw} imes ext{RTprop}$.

If intermediate network links re-route or route flaps occur, tcpi_min_rtt jumps abruptly, signaling physical path changes.

Authoring a Custom bpftrace Min-RTT Telemetry Script

To inspect real-time minimum RTT updates and detect path route changes, write an eBPF script using bpftrace:

#!/usr/bin/env bpftrace

#include <net/sock.h>
#include <linux/tcp.h>

kprobe:tcp_update_rtt_min
{
  $sk = (struct sock *)arg0;
  $tp = (struct tcp_sock *)arg0;

  $min_rtt_us = $tp->rtt_min[0].rtt;
  if ($min_rtt_us > 0 && $min_rtt_us < 10000000) {
    @min_rtt_distribution_us = hist($min_rtt_us);
    @rtt_filter_evaluations = count();
  }
}

interval:s:10
{
  print(@rtt_filter_evaluations);
  print(@min_rtt_distribution_us);
  clear(@rtt_filter_evaluations);
  clear(@min_rtt_distribution_us);
}

Save this script as trace_min_rtt.bt. It instruments tcp_update_rtt_min() to track kernel min-RTT distribution histograms.

Executing and Evaluating Kernel Telemetry

Run the bpftrace monitoring script with administrative privileges:

sudo bpftrace trace_min_rtt.bt

Monitor the telemetry metrics during active connection sessions:

• Physical baseline latency: The lowest bucket in @min_rtt_distribution_us reveals the true optical or wireless propagation floor.
• Bufferbloat identification: Compare tcpi_min_rtt against tcpi_rtt (smoothed RTT). A wide gap indicates persistent queue accumulation along the path.
• Route flap detection: Abrupt upward shifts in the histogram without link saturation signal that BGP or SD-WAN has rerouted traffic across longer physical hops.

Host Tuning Guidelines

To ensure high accuracy in minimum RTT tracking:

1. Ensure TCP Timestamps are active (sysctl net.ipv4.tcp_timestamps=1) for microsecond precision.
2. Use Fair Queueing (FQ) to prevent local NIC queue buildup from corrupting RTT sample baselines.