Non-HTTP protocols (Redis, SQL, gRPC, etc.) lack an application-layer header like HTTP's Host header that contains the original destination hostname. When the destination Pod IP cannot be resolved via K8s metadata, these protocols have no fallback, resulting in "outgoing" in service graphs.
Potential approaches to explore:
- RDNS (Reverse DNS cache): Capture DNS query responses via eBPF and map IPs to hostnames
- Pre-NAT TC hooks: Capture the original Service ClusterIP before kube-proxy NAT translation
- Connection tracking: Record the DNS name used when establishing TCP connections
The chosen solution should extract both the service name and namespace from K8s FQDNs to enable accurate cross-namespace service graph connections.