// CLI: -t mangle -A ISTIO_PRERT -s 169.254.7.127 -p tcp -m tcp --dport <PROBEPORT> -j ACCEPT
	//
	// DESC: If this is one of our node-probe ports and is from our SNAT-ed/"special" hostside IP, short-circuit out here
	iptablesBuilder.AppendRule(iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,
		"-s", hostProbeSNAT.String(),
		"-p", "tcp",
		"-m", "tcp",

	h.Lock()
	defer h.Unlock()
	h.LastCheckFailure = reqStartTime
}

func (h *metrics) updateLastFullMinute(currReqMinute time.Time) {
	// Assumes the caller has h.Lock()'ed
	h.lastFullMinute = h.currentMinute
	h.currentMinute = serviceRTTMinuteStats{
		statsTime: currReqMinute,
	}
}

func (h *metrics) accumRequestRTT(reqStartTime time.Time, rttMs float64, isSuccess bool) {