Repository navigation
Cap protocol classification attempts per connection - #376
Open
LouisParkin wants to merge 6 commits into
Open
LouisParkin wants to merge 6 commits into
LouisParkin wants to merge 6 commits into
Conversation
Pulls in the fork change that stops USM classification of connections whose protocol is never recognised once they use their budget of attempts, which removed most of the throughput loss on dense nodes. STS_PROTOCOL_CLASSIFICATION_HANDSHAKE_BUDGET and STS_PROTOCOL_CLASSIFICATION_MID_STREAM_BUDGET override the budgets for connections with and without an observed handshake; unset or out of range keeps the eBPF defaults. Fixes #354 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
craffit
reviewed
Oct 28, 2026
| DisabledProtocols []string | ||
| // Packet inspections allowed on a connection with an unrecognised protocol, with and without an observed | ||
| // handshake. Zero selects the eBPF default. | ||
| ClassificationHandshakeBudget uint16 |
There was a problem hiding this comment.
What does 'Budget' mean? I think this should have some kind of unit in the name to understand what the budget means
Author
There was a problem hiding this comment.
Renamed to ClassificationHandshakeMaxSegments / ClassificationMidStreamMaxSegments, env vars STS_PROTOCOL_CLASSIFICATION_{HANDSHAKE,MID_STREAM}_MAX_SEGMENTS, in 5f32d1e. The budget now counts data segments, each counted once across hooks.
Renames the budget settings and env vars to *_MAX_SEGMENTS so the unit is explicit, matching the fork's per-segment accounting. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Picks up the review fixes in datadog-agent-upstream-for-process-agent#854: USM shares the tracer's budget map, segments are counted once, and entries are removed on tcp_close. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Picks up the retry-budget fix from StackVista/datadog-agent-upstream-for-process-agent#854. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
craffit
approved these changes
Oct 29, 2026
StackVista/datadog-agent-upstream-for-process-agent#854 is merged as c5edc213. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The old module path no longer resolves (a new, tagless repo now sits at it), which fails go mod download in CI. Replaces do not propagate from dependencies, so this mirrors the fork's replace, and temporarily points the fork at the replace-csaf-poc branch until that PR merges. Refs #381 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #354
This bumps the fork to StackVista/datadog-agent-upstream-for-process-agent#854, which stops classifying a connection whose protocol is never recognised once it has used its budget of data segments. In the local reproduction with 3000 busy connections, this image raised throughput from 26.6 to 32.6 Gbps (42.3 Gbps with the agent off).
Two new environment variables override the budgets. If unset or out of range, the eBPF defaults apply:
STS_PROTOCOL_CLASSIFICATION_HANDSHAKE_MAX_SEGMENTSSTS_PROTOCOL_CLASSIFICATION_MID_STREAM_MAX_SEGMENTSThe fork replace temporarily points at StackVista/datadog-agent-upstream-for-process-agent#855 (
f82aa1c5, includes the merged cap), which fixes the unrelated csaf module breakage (#381). It will be repointed atstackstate-7.62.2once that merges.