How to Trace TCP Socket TCP_INFO tcpi_retrans_synack TCP TCP-AO Asymmetric Segment Hardware Key Rollover Window Clamp GTP-U Encap Drops in Linux Using eBPF

Enterprise data centre fabrics, 5G core network user-plane functions (UPFs), and secure hybrid cloud tunnels increasingly rely on RFC 5925 TCP Authentication Option (TCP-AO) to protect long-lived BGP sessions and high-throughput overlay transport links. When combining TCP-AO with GPRS Tunnelling Protocol User Plane (GTP-U encapsulation over UDP port 2152) in cellular backhauls, subtle kernel-level packet drops can emerge during asymmetric hardware key rollovers and window clamping events. Under bursty connection handshakes, failed key derivations or misaligned Master Key Tuples (MKTs) manifest as unexpected SYN-ACK retransmissions tracked in the socket’s tcp_info.tcpi_retrans_synack metric. Tracing these encapsulated packet drops requires low-overhead eBPF kprobes and tracepoints attached to kernel networking hooks. This technical guide outlines how to trace, filter, and diagnose TCP-AO GTP-U encapsulation drops using eBPF in Linux.

Linux Kernel GTP-U and TCP-AO Interaction

In the Linux kernel network stack, GTP-U tunnel processing interacts directly with drivers/net/gtp.c, net/ipv4/udp.c, and the TCP-AO verification engine in net/ipv4/tcp_ao.c. When an authenticated TCP control segment is encapsulated within an outer GTP-U header carrying specific Tunnel Endpoint Identifiers (TEIDs), each packet must satisfy both GTP-U PDU parsing rules and the TCP-AO Message Authentication Code (MAC) verification routines.

During an automated key rollover, if the transmitting peer increments its Send Key ID (KeyID) before the receiving host completes its local MKT rotation, the TCP-AO verification routine rejects the segment. If this occurs on a connection attempt, the kernel increments tcpi_retrans_synack and invokes kfree_skb() with the reason SKB_DROP_REASON_TCP_AOFAILURE. Without eBPF tracing, identifying whether the failure originated from GTP-U TEID demultiplexing, window clamping, or TCP-AO crypto negotiation is virtually impossible.

Developing the eBPF Tracing Program

We implement a targeted BPF CO-RE (Compile Once – Run Everywhere) program using kprobe:tcp_ao_verify_hash and kprobe:gtp_encap_recv to monitor segment integrity:

#include <vmlinux.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>

struct drop_event_t {
    u32 saddr;
    u32 daddr;
    u16 sport;
    u16 dport;
    u32 retrans_synack;
    u32 window_clamp;
    u8 keyid_snd;
    u8 keyid_rcv;
    u32 drop_reason;
};

struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 256 * 1024);
} drop_events SEC(".maps");

SEC("kprobe/tcp_ao_verify_hash")
int BPF_KPROBE(trace_tcp_ao_verify, struct sock *sk, struct sk_buff *skb,
               unsigned short int aoh_offset, struct tcp_ao_key *key)
{
    struct tcp_sock *tp = (struct tcp_sock *)sk;
    struct drop_event_t *event;

    u32 retrans = BPF_CORE_READ(tp, retrans_synack);
    u32 clamp = BPF_CORE_READ(tp, window_clamp);

    if (retrans == 0)
        return 0;

    event = bpf_ringbuf_reserve(&drop_events, sizeof(*event), 0);
    if (!event)
        return 0;

    struct inet_sock *inet = (struct inet_sock *)sk;
    event->saddr = BPF_CORE_READ(inet, inet_saddr);
    event->daddr = BPF_CORE_READ(inet, inet_daddr);
    event->sport = bpf_ntohs(BPF_CORE_READ(inet, inet_sport));
    event->dport = bpf_ntohs(BPF_CORE_READ(sk, __sk_common.skc_dport));
    event->retrans_synack = retrans;
    event->window_clamp = clamp;
    event->keyid_snd = BPF_CORE_READ(key, sndid);
    event->keyid_rcv = BPF_CORE_READ(key, rcvid);
    event->drop_reason = 0xAO06;

    bpf_ringbuf_submit(event, 0);
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

Compiling and Loading with bpftool

Compile the BPF source into an ELF object file using Clang/LLVM and attach the program to the target kernel probe points:

# Compile the eBPF probe with modern CO-RE targets
clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -I/usr/include/x86_64-linux-gnu -c tcp_ao_gtp_trace.bpf.c -o tcp_ao_gtp_trace.bpf.o

# Load and pin the BPF program into the kernel filesystem
bpftool prog load tcp_ao_gtp_trace.bpf.o /sys/fs/bpf/tcp_ao_gtp_trace type kprobe

# Attach to kernel function entry point
bpftool prog attach pinned /sys/fs/bpf/tcp_ao_gtp_trace kprobe tcp_ao_verify_hash

Analyzing Socket Telemetry and Kernel Drops

Monitor the user-space ring buffer or leverage bpftool prog tracelog to capture live drop events:

• Inspect socket statistics with ss -tiepm '( sport = :179 or dport = :179 )' to verify tcpi_retrans_synack counters and window clamp states.
• Correlate captured KeyIDs against configured MKT parameters via ip link show type gtp and ip tcp_ao show.
• Verify that TCP MSS clamping on the cellular GTP-U interface accounts for outer UDP and GTP-U header overhead, preventing MTU fragmentation during cryptographic authentication.