Cap protocol classification attempts per connection

config/config.go

@@ -100,6 +100,10 @@ type NetworkTracerConfig struct {
 	MaxHTTPObservationsBuffered int
 	// Protocols to disable, mostly for debugging
 	DisabledProtocols []string
+	// Data segments, counted over both directions, after which classification of a connection with an
+	// unrecognised protocol stops, with and without an observed handshake. Zero selects the eBPF default.
+	ClassificationHandshakeMaxSegments uint16
+	ClassificationMidStreamMaxSegments uint16
 	// Pod correlation configuration
 	PodCorrelation PodCorrelationConfig
 }
@@ -553,6 +557,14 @@ func mergeEnvironmentVariables(c *AgentConfig) *AgentConfig {
 		c.NetworkTracer.MaxHTTPObservationsBuffered = maxObs
 	}
 
+	if segments, err := strconv.ParseUint(os.Getenv("STS_PROTOCOL_CLASSIFICATION_HANDSHAKE_MAX_SEGMENTS"), 10, 16); err == nil {
+		c.NetworkTracer.ClassificationHandshakeMaxSegments = uint16(segments)
+	}
+
+	if segments, err := strconv.ParseUint(os.Getenv("STS_PROTOCOL_CLASSIFICATION_MID_STREAM_MAX_SEGMENTS"), 10, 16); err == nil {
+		c.NetworkTracer.ClassificationMidStreamMaxSegments = uint16(segments)
+	}
+
 	if v := os.Getenv("STS_DISABLED_PROTOCOLS"); v != "" {
 		protocols := strings.Split(v, ",")
 		for i, proto := range protocols {

config/config_test.go

@@ -652,6 +652,17 @@ func TestEnvOverrides(t *testing.T) {
 	assert.Equal(true, slices.Contains(agentConfig.NetworkTracer.DisabledProtocols, HTTPProtocolName))
 }
 
+func TestEnvClassificationMaxSegments(t *testing.T) {
+	t.Setenv("STS_PROTOCOL_CLASSIFICATION_HANDSHAKE_MAX_SEGMENTS", "32")
+	t.Setenv("STS_PROTOCOL_CLASSIFICATION_MID_STREAM_MAX_SEGMENTS", "70000")
+
+	agentConfig, _ := NewAgentConfig(nil)
+	tracerCfg := TracerConfig(agentConfig)
+
+	assert.Equal(t, uint16(32), tracerCfg.ProtocolClassificationHandshakeMaxSegments)
+	assert.Equal(t, uint16(0), tracerCfg.ProtocolClassificationMidStreamMaxSegments, "out-of-range value keeps the eBPF default")
+}
+
 func TestEnvSiteConfig(t *testing.T) {
 	assert := assert.New(t)
 	for _, tc := range []struct {

config/tracer_config.go

@@ -50,7 +50,9 @@ func TracerConfig(cfg *AgentConfig) *tracerConfig.Config {
 		MaxDNSStatsBuffered: 75000,
 		DNSTimeout:          15 * time.Second,
 
-		ProtocolClassificationEnabled: cfg.NetworkTracer.EnableProtocolInspection,
+		ProtocolClassificationEnabled:              cfg.NetworkTracer.EnableProtocolInspection,
+		ProtocolClassificationHandshakeMaxSegments: cfg.NetworkTracer.ClassificationHandshakeMaxSegments,
+		ProtocolClassificationMidStreamMaxSegments: cfg.NetworkTracer.ClassificationMidStreamMaxSegments,
 
 		EnableHTTPMonitoring:  cfg.NetworkTracer.EnableProtocolInspection && !slices.Contains(cfg.NetworkTracer.DisabledProtocols, HTTPProtocolName),
 		EnableHTTP2Monitoring: cfg.NetworkTracer.EnableProtocolInspection && !slices.Contains(cfg.NetworkTracer.DisabledProtocols, HTTP2ProtocolName),