How to Trace TCP Socket TCP_INFO tcpi_retrans_synack Drop Rates in Linux Using eBPF

Measuring inbound SYN-ACK drop rates across public-facing ingress servers provides critical operational visibility into return-path packet loss and asymmetric network routing. The Linux kernel struct tcp_info records initial handshake retransmissions under tcpi_retrans_synack. Tracing this value with eBPF gives real-time visibility into server handshake drop rates before listen backlog exhaustion drops pending connections.

Understanding SYN-ACK Drop Dynamics

When a server accepts a connection request, it sends a SYN-ACK and waits for the final ACK. If no acknowledgment arrives within the initial RTO interval, the kernel retransmits the SYN-ACK according to net.ipv4.tcp_synack_retries. Tracking these drop rates exposes transient client reachability issues before handshake timeouts drop sockets.

eBPF BCC Program for SYN-ACK Drop Rate Tracing

The following BCC Python script attaches to inet_rtx_syn_ack to capture SYN-ACK drop rates:

from bcc import BPF

bpf_source = """
#include <net/sock.h>
#include <linux/tcp.h>

struct synack_drop_event_t {
    u32 pid;
    u16 sport;
    u16 dport;
    u32 saddr;
    u32 daddr;
};

BPF_PERF_OUTPUT(synack_drop_events);

int trace_synack_drop(struct pt_regs *ctx, const struct sock *sk) {
    if (sk->sk_family != AF_INET)
        return 0;

    struct synack_drop_event_t evt = {};
    evt.pid = bpf_get_current_pid_tgid() >> 32;
    evt.sport = sk->sk_num;
    evt.dport = bpf_ntohs(sk->sk_dport);
    evt.saddr = sk->sk_rcv_saddr;
    evt.daddr = sk->sk_daddr;

    synack_drop_events.perf_submit(ctx, &evt, sizeof(evt));
    return 0;
}
"""

b = BPF(text=bpf_source)
b.attach_kprobe(event="inet_rtx_syn_ack", fn_name="trace_synack_drop")

def print_synack_drop(cpu, data, size):
    e = b["synack_drop_events"].event(data)
    print(f"SYN-ACK DROP: Server port {e.sport} -> Client {e.dport} dropped handshake!")

b["synack_drop_events"].open_perf_buffer(print_synack_drop)
print("Listening for TCP SYN-ACK drop rates... Press Ctrl+C to terminate.")
while True:
    b.perf_buffer_poll()

Operational Diagnosis and Network Tuning

Run the script under root privileges:

sudo python3 trace_synack_drop.py

High SYN-ACK drop rates indicate return-path firewall throttling or client-side connection abandonment.