How to Trace TCP Socket TCP_INFO tcpi_min_rtt Sample Intervals in Linux Using eBPF

Modern TCP congestion control algorithms—most notably Google’s BBR (Bottleneck Bandwidth and RTT)—rely on accurate tracking of the minimum round-trip time (min_rtt) observed over a sliding time window. While smoothed RTT (tcpi_rtt) measures instantaneous latency that fluctuates with buffer queuing and cross-traffic, min_rtt captures the physical speed-of-light propagation delay of the network path without bufferbloat. If the kernel’s min_rtt filter fails to expire stale samples or if route changes alter the physical path, congestion controllers can underestimate available bandwidth or induce persistent buffer queues.

Inside the Linux networking subsystem, the minimum RTT is recorded in struct tcp_info as tcpi_min_rtt. Using extended Berkeley Packet Filter (eBPF) and bpftrace, systems engineers can trace tcpi_min_rtt update intervals to verify congestion control calibration non-invasively.

Understanding min_rtt Tracking in the Linux Kernel

Inside struct tcp_sock and exposed through include/uapi/linux/tcp.h, the kernel maintains the minimum RTT filter:

struct tcp_info {
    /* ... state fields ... */
    __u32   tcpi_rtt;       /* Smoothed RTT (us) */
    __u32   tcpi_rttvar;    /* RTT variance (us) */
    __u32   tcpi_snd_ssthresh;
    __u32   tcpi_snd_cwnd;
    __u32   tcpi_min_rtt;   /* Minimum RTT seen over sample window (us) */
};

BBR executes a periodic “ProbeRTT” phase every 10 seconds, cutting the congestion window to 4 packets to drain bottleneck queues and measure a fresh, accurate min_rtt. If tcpi_min_rtt diverges significantly from recent smoothed RTTs during steady state, intermediate buffers are perpetually bloated.

Authoring the bpftrace Minimum RTT Probe

The following bpftrace script monitors tcp_update_rtt_min() to track when new propagation floors are established:

#!/usr/bin/env bpftrace

#include <net/sock.h>
#include <linux/tcp.h>

kprobe:tcp_update_rtt_min
{
    $sk = (struct sock *)arg0;
    $inet = (struct inet_sock *)$sk;
    $tp = (struct tcp_sock *)$sk;

    $daddr = ntop($inet->inet_daddr);
    $saddr = ntop($inet->inet_saddr);
    $dport = bswap($inet->inet_dport);
    $min_rtt_us = $tp->rtt_min.val[0];
    $srtt_us = $tp->srtt_us >> 3;

    time("%H:%M:%S ");
    printf("MIN_RTT SAMPLE | %s -> %s:%d | Min_RTT: %d us | SRTT: %d us | Buffer Bloat: %d us\n",
        $saddr, $daddr, $dport, $min_rtt_us, $srtt_us,
        $srtt_us > $min_rtt_us ? $srtt_us - $min_rtt_us : 0);
}

Running the Trace and Diagnosing Buffer Bloat

Run the script on your Linux database server or edge gateway:

sudo bpftrace trace_min_rtt.bt

The output streams active socket telemetry in real time:

23:05:10 MIN_RTT SAMPLE | 10.0.1.20 -> 93.184.216.34:443 | Min_RTT: 18200 us | SRTT: 21400 us | Buffer Bloat: 3200 us
23:05:20 MIN_RTT SAMPLE | 10.0.1.20 -> 93.184.216.34:443 | Min_RTT: 18200 us | SRTT: 78500 us | Buffer Bloat: 60300 us

The second sample flags a serious buffer bloat condition: while the physical path minimum RTT is 18.2ms, excessive queuing inflated the active RTT to 78.5ms (over 60ms of unnecessary latency).

Production Tuning and Analysis

Tracking tcpi_min_rtt via eBPF helps systems teams:

1. Validate that BBR is actively triggering ProbeRTT to recalculate the baseline latency floor.
2. Detect unannounced WAN route failovers where physical propagation delay changes permanently.
3. Configure queue management algorithms on upstream network interfaces to minimize buffer bloat under sustained loads.