How to Trace TCP Socket TCP_INFO tcpi_retrans_syn Retransmission Loss in Linux Using eBPF

Measuring outbound TCP SYN packet losses across high-frequency RPC clients provides critical operational visibility into intermediate firewall throttling and gateway drops. The Linux kernel struct tcp_info records initial handshake retransmissions under tcpi_retrans_syn. Tracing this value with eBPF gives real-time visibility into client connection establishment losses before connection pool timeouts drop pending tasks.

Understanding SYN Loss Dynamics

When an application attempts to establish a connection via connect(), it sends a SYN packet. If no acknowledgment arrives within the initial RTO interval, the kernel initiates exponential backoff retries governed by net.ipv4.tcp_syn_retries. Tracking these losses exposes transient routing issues before connection timeouts affect users.

eBPF BCC Program for SYN Loss Tracing

The following BCC Python script attaches to tcp_retransmit_skb to capture SYN packet losses:

from bcc import BPF

bpf_source = """
#include <net/sock.h>
#include <linux/tcp.h>

struct syn_loss_event_t {
    u32 pid;
    u16 sport;
    u16 dport;
    u32 saddr;
    u32 daddr;
};

BPF_PERF_OUTPUT(syn_loss_events);

int trace_syn_loss(struct pt_regs *ctx, struct sock *sk) {
    if (sk->sk_family != AF_INET)
        return 0;

    struct tcp_sock *tp = tcp_sk(sk);
    if (sk->sk_state == TCP_SYN_SENT) {
        struct syn_loss_event_t evt = {};
        evt.pid = bpf_get_current_pid_tgid() >> 32;
        evt.sport = sk->sk_num;
        evt.dport = bpf_ntohs(sk->sk_dport);
        evt.saddr = sk->sk_rcv_saddr;
        evt.daddr = sk->sk_daddr;
        syn_loss_events.perf_submit(ctx, &evt, sizeof(evt));
    }
    return 0;
}
"""

b = BPF(text=bpf_source)
b.attach_kprobe(event="tcp_retransmit_skb", fn_name="trace_syn_loss")

def print_loss(cpu, data, size):
    e = b["syn_loss_events"].event(data)
    print(f"SYN LOSS: Client port {e.sport} -> Server {e.dport} dropped initial SYN!")

b["syn_loss_events"].open_perf_buffer(print_loss)
print("Listening for TCP SYN retransmission losses... Press Ctrl+C to terminate.")
while True:
    b.perf_buffer_poll()

Operational Diagnosis and Network Tuning

Run the script under root privileges:

sudo python3 trace_syn_loss.py

High SYN drop counts indicate intermediate security gateway drops or remote listen backlog exhaustion.