How to Trace TCP Socket TCP_INFO tcpi_retrans_synack SACK Permitted Option Drops in Linux Using eBPF

Selective Acknowledgment (SACK, RFC 2018) allows TCP endpoints to acknowledge non-contiguous packet blocks, drastically improving loss recovery during packet drops. However, legacy middleboxes and misconfigured security appliances frequently drop or corrupt SACK-Permitted options (Kind 4) during connection negotiation. When a client advertises SACK-Permitted and intermediate middleboxes reject SYN-ACK segments carrying SACK options, the handshake stalls. The server triggers repeated SYN-ACK retransmissions, tracked inside tcpi_retrans_synack. Extended Berkeley Packet Filter (eBPF) provides kernel-level visibility into these handshake stalls.

Mechanisms of SACK Permitted Option Drops

During the TCP three-way handshake, if net.ipv4.tcp_sack = 1 is set, the kernel attaches SACK-Permitted options to the SYN-ACK segment. If middleboxes drop segments with unrecognized options or strip SACK parameters, packet recovery collapses to legacy go-back-N retransmissions or connections drop completely. The server’s retransmission timer fires repeatedly, incrementing tcpi_retrans_synack. Tracing kernel option parsing routines isolates options corruption from physical packet loss.

Constructing the bpftrace SACK Permitted Monitor

The following bpftrace script captures SACK-Permitted negotiation anomalies and correlates them with SYN-ACK retransmissions:

#!/usr/bin/env bpftrace

#include <net/sock.h>
#include <net/inet_connection_sock.h>
#include <linux/tcp.h>

BEGIN
{
  printf("Tracing SACK-Permitted drops and retransmissions... Hit Ctrl-C to finish.
");
}

kprobe:inet_rtx_syn_ack
{
  $req = (struct request_sock *)arg1;
  $daddr = ntop($req->ir_rmt_addr);
  $dport = bswap($req->ir_rmt_port);
  $retries = $req->num_retrans;

  if ($retries >= 1) {
    @synack_retries_under_sack[$daddr] = count();
  }
}

interval:s:15
{
  time("%H:%M:%S ");
  printf("--- SACK Permitted Retransmission Summary ---
");
  print(@synack_retries_under_sack);
  clear(@synack_retries_under_sack);
}

END
{
  clear(@synack_retries_under_sack);
}

Running and Interpreting Kernel Diagnostics

Run the script on the target Linux host with administrative privileges:

sudo bpftrace synack_sack_drops.bt

When middleboxes drop SACK-Permitted segments, the diagnostic stream prints:

17:12:25 --- SACK Permitted Retransmission Summary ---
@synack_retries_under_sack[203.0.113.158]: 3

Remediation Strategies and Configuration Auditing

To optimize SACK handling behavior and eliminate middlebox interference:

• Verify SACK Setting: Ensure net.ipv4.tcp_sack = 1 is active in /etc/sysctl.conf.
• Check Middlebox Option Scrubbing: Verify that intermediate firewalls permit TCP Option Kind 4 without stripping or rewriting parameters.
• Inspect Loss Recovery: Check netstat -s | grep -i sack to confirm whether active connections utilize selective acknowledgments efficiently.