How to Trace TCP Socket TCP_INFO tcpi_sacked Out-of-Order Packets in Linux Using eBPF

Selective Acknowledgment (SACK) is the backbone of high-performance TCP loss recovery, informing senders exactly which non-contiguous blocks of data have reached the receiver. The Linux kernel struct tcp_info records tcpi_sacked, representing the number of out-of-order segments currently acknowledged by SACK scoreboard entries. Tracing this value with eBPF gives real-time visibility into loss recovery efficiency.

Understanding SACK Scoreboard Dynamics

When packets are reordered or lost, receivers send SACK options indicating contiguous blocks received ahead of sequence gaps. tcpi_sacked tracks these acknowledged blocks, allowing senders to retransmit only missing sequence holes rather than resending entire windows. Spikes in tcpi_sacked highlight frequent network reordering or selective loss episodes.

eBPF BCC Program for SACK Observation

The following BCC Python script attaches to tcp_sacktag_write_queue to log SACK scoreboard updates:

from bcc import BPF

bpf_source = """
#include <net/sock.h>
#include <linux/tcp.h>

struct sack_event_t {
    u32 pid;
    u16 sport;
    u16 dport;
    u32 sacked_segs;
};

BPF_PERF_OUTPUT(sack_events);

int trace_sack(struct pt_regs *ctx, struct sock *sk) {
    if (sk->sk_family != AF_INET)
        return 0;

    struct tcp_sock *tp = tcp_sk(sk);
    struct sack_event_t evt = {};

    evt.pid = bpf_get_current_pid_tgid() >> 32;
    evt.sport = sk->sk_num;
    evt.dport = bpf_ntohs(sk->sk_dport);
    evt.sacked_segs = tp->sacked_out;

    sack_events.perf_submit(ctx, &evt, sizeof(evt));
    return 0;
}
"""

b = BPF(text=bpf_source)
b.attach_kprobe(event="tcp_sacktag_write_queue", fn_name="trace_sack")

def print_sack(cpu, data, size):
    e = b["sack_events"].event(data)
    print(f"SACK: PID {e.pid:<6} | Port {e.sport} -> {e.dport} | SACKed Out: {e.sacked_segs} segs")

b["sack_events"].open_perf_buffer(print_sack)
print("Listening for TCP SACK scoreboard events... Press Ctrl+C to terminate.")
while True:
    b.perf_buffer_poll()

Operational Diagnosis and Network Tuning

Run the script under root privileges:

sudo python3 trace_sacked.py

High SACK activity confirms that Selective Acknowledgment is successfully preventing full go-back-N window collapses.