How to Trace TCP Socket TCP_INFO tcpi_retrans_synack TCP Timestamp Option Drops in Linux Using eBPF

TCP Timestamps (RFC 7323) provide essential round-trip time measurements and Protection Against Wrapped Sequence Numbers (PAWS) in high-bandwidth networks. However, legacy firewalls and intermediate NAT gateways frequently strip, zero out, or corrupt timestamp options. When an active client presents non-monotonic timestamp echoes or when intermediate middleboxes drop SYN-ACK segments carrying timestamp options, connection negotiation stalls. The server triggers repeated SYN-ACK retransmissions, tracked inside tcpi_retrans_synack. Extended Berkeley Packet Filter (eBPF) provides kernel-level visibility into these handshake stalls.

Mechanisms of TCP Timestamp Invalidation and Drops

During the TCP three-way handshake, if net.ipv4.tcp_timestamps = 1 is set, the kernel attaches timestamp options to the SYN-ACK segment. If middleboxes drop segments with unrecognized options or rewrite timestamps non-monotonically, the client discards the response under PAWS rules. The server’s retransmission timer fires repeatedly, incrementing tcpi_retrans_synack. Tracing kernel timestamp parsing routines isolates options corruption from physical packet loss.

Constructing the bpftrace Timestamp Monitor

The following bpftrace script captures failed timestamp evaluations and correlates them with SYN-ACK retransmissions:

#!/usr/bin/env bpftrace

#include <net/sock.h>
#include <net/inet_connection_sock.h>
#include <linux/tcp.h>

BEGIN
{
  printf("Tracing TCP timestamp drops and retransmissions... Hit Ctrl-C to finish.
");
}

kprobe:tcp_parse_options
{
  $skb = (struct sk_buff *)arg1;
  @timestamp_checks_total = count();
}

kprobe:inet_rtx_syn_ack
{
  $req = (struct request_sock *)arg1;
  $daddr = ntop($req->ir_rmt_addr);
  $dport = bswap($req->ir_rmt_port);
  $retries = $req->num_retrans;

  if ($retries >= 1) {
    @synack_retries_under_ts[$daddr] = count();
  }
}

interval:s:15
{
  time("%H:%M:%S ");
  printf("--- TCP Timestamp & Retransmission Summary ---
");
  print(@timestamp_checks_total);
  print(@synack_retries_under_ts);
  clear(@timestamp_checks_total);
  clear(@synack_retries_under_ts);
}

END
{
  clear(@timestamp_checks_total);
  clear(@synack_retries_under_ts);
}

Running and Interpreting Kernel Diagnostics

Run the script on the target Linux host with administrative privileges:

sudo bpftrace synack_timestamp_drops.bt

When middleboxes drop timestamp segments, the diagnostic stream prints:

17:08:25 --- TCP Timestamp & Retransmission Summary ---
@timestamp_checks_total: 184
@synack_retries_under_ts[203.0.113.142]: 5

Remediation Strategies and Configuration Auditing

To optimize TCP timestamp behavior and eliminate middlebox interference:

• Audit Sysctl Timestamp Setting: Test setting net.ipv4.tcp_timestamps = 2 (enabling random offset timestamps) to bypass middleboxes blocking predictable boots.
• Check PAWS Failures: Check netstat -s | grep -i paws to confirm whether dropped packets trigger PAWS rejection counters.
• Verify Middlebox Option Permissibility: Ensure security gateways do not scrub TCP Option Kind 8 from transit traffic.