netobserv-ebpf-agent
netobserv-ebpf-agent copied to clipboard
Invalid src and dst IPs when RTT is enabled for gRPC traffic
Here is an example of invalid IPs for gRPC traffic
ipv4: 13:59:40.537606 eth0 IP 128.120.33.77:32888 > 138.28.0.0:8525: dscp: 0x14 protocol:tcp type: 0 code: 0 dir:0 bytes:32 packets:1 flags:16 ends: 13:59:40.537606 dnsId: 0 dnsFlags: 0x0000 dnsLatency(ms): 0 rtt(ns) 9899000 DropPkts: 0 DropBytes: 0 DropCause 0 ipv4: 13:59:37.698857 eth1 IP 214.144.33.77:54928 > 233.230.0.0:8525: dscp: 0x14 protocol:tcp type: 0 code: 0 dir:0 bytes:32 packets:1 flags:16 ends: 13:59:37.698857 dnsId: 0 dnsFlags: 0x0000 dnsLatency(ms): 0 rtt(ns) 2717000 DropPkts: 0 DropBytes: 0 DropCause 0
you can see that the last 2 octets are the same. The IPs should be 10.9.x.x. Here is an example of non-gRPC traffic where IPs are correct
ipv4: 14:08:42.804832 eth1 IP 10.9.69.17:3000 > 10.9.37.63:39946: dscp: 0x0 protocol:tcp type: 0 code: 0 dir:0 bytes:66 packets:1 flags:16 ends: 14:08:42.804832 dnsId: 0 dnsFlags: 0x0000 dnsLatency(ms): 0 rtt(ns) 10000 DropPkts: 0 DropBytes: 0 DropCause 0 ipv4: 14:08:42.804849 eth1 IP 10.9.76.28:3000 > 10.9.37.63:37434: dscp: 0x0 protocol:tcp type: 0 code: 0 dir:0 bytes:66 packets:1 flags:16 ends: 14:08:42.804849 dnsId: 0 dnsFlags: 0x0000 dnsLatency(ms): 0 rtt(ns) 10000 DropPkts: 0 DropBytes: 0 DropCause 0
kernel version: 5.15.0-112-generic tested version: build from main branch and 1.6.1-community
This happens only when ENABLE_RTT=true and only for gRPC traffic. IPs for other traffic look ok also if RTT is disabled IPs for gRPC traffic look ok.