How to Trace TCP Socket TCP_INFO tcpi_retrans_synack TCP Selective ACK SACK Permitted Handshake Option Drops in Linux Using eBPF

Selective Acknowledgement (SACK) negotiation occurs during the initial TCP three-way handshake when both endpoints exchange the SACK-Permitted option (Kind=4, Length=2, RFC 2018). However, obsolete stateful inspection firewalls, misconfigured WAN optimization controllers, or asymmetric middleboxes occasionally strip unknown TCP options or drop SYN segments containing modern option headers. When the server transmits a SYN-ACK containing SACK-Permitted and middleboxes discard the segment, the connection stalls into exponential retransmissions, escalating tcpi_retrans_synack. Extended Berkeley Packet Filters (eBPF) enable non-intrusive kernel tracing to isolate SACK-Permitted option drops in real time.

Kernel Mechanics of SACK-Permitted Negotiation

Inside the Linux network stack, the kernel evaluates incoming SYN options inside tcp_parse_options(). If net.ipv4.tcp_sack = 1 is set, the kernel notes sack_ok = 1 in struct tcp_request_sock_ops.

When generating the SYN-ACK response, tcp_synack_options() attaches the SACK-Permitted option. If upstream packet sanitizers drop the response due to strict option-length filters, the client never receives the SYN-ACK, forcing the server to retransmit the segment repeatedly until timeout exhaustion. Extended Berkeley Packet Filters allow systems engineers to monitor exact sequence disparities inside kernel tracepoints without overhead.

Authoring the Diagnostic Probe with bpftrace

Construct a dedicated bpftrace script that intercepts TCP SACK option parsing and correlates dropped handshakes with SYN-ACK retransmits:

#!/usr/bin/env bpftrace
/* trace_sack_permitted_drops.bt - Trace Linux TCP SACK-Permitted handshake drops */

#include <net/sock.h>
#include <linux/tcp.h>

tracepoint:tcp:tcp_retransmit_synack
{
    $sk = (struct sock *)args->skaddr;
    $saddr = ntop(args->saddr);
    $daddr = ntop(args->daddr);
    $sport = args->sport;
    $dport = args->dport;

    printf("SYN-ACK Retransmit: %s:%d -> %s:%d (SACK Option Drop Suspect)
",
           $saddr, $sport, $daddr, $dport);
    @synack_retransmits[$saddr, $daddr] = count();
}

kprobe:tcp_parse_options
{
    $skb = (struct sk_buff *)arg1;
    @option_checks = count();
}

interval:s:5
{
    time("%H:%M:%S ");
    printf("--- TCP SACK Option Activity (5s Window) ---
");
    print(@option_checks);
    print(@synack_retransmits);
    clear(@option_checks);
    clear(@synack_retransmits);
}

Running the Trace on Production Linux Systems

Deploy the probe with root privileges on the target server:

# Install bpftrace and kernel dependencies
sudo apt-get update && sudo apt-get install -y bpftrace linux-headers-$(uname -r)

# Execute the trace
sudo bpftrace trace_sack_permitted_drops.bt

Kernel Optimization and Parameter Tuning

To inspect and temporarily toggle TCP SACK configuration for network path diagnostics:

# Check current TCP SACK status
sysctl net.ipv4.tcp_sack

# Toggle SACK if middlebox path corruption is identified
sudo sysctl -w net.ipv4.tcp_sack=0

By pairing eBPF kernel instrumentation with calibrated sysctl adjustments, network engineers can eliminate elusive SYN-ACK stalls while preserving essential throughput boundaries.