cluster/agent                                                       cluster/agent                         -        -          -               STATIC     
cluster/inbound-vip|8000|http|httpbin.default.svc.cluster.local     httpbin.default.svc.cluster.local     8000     http       inbound-vip     EDS        
cluster/prometheus_stats                                            cluster/prometheus_stats              -        -          -               STATIC     

ECDS NAME                                                     TYPE
istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP      
istio.io/telemetry/stats/prometheus/sidecar/Inbound/TCP       
istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP     
istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP      
default.display-metadata                                      envoy.extensions.filters.http.wasm.v3.Wasm

   * direction streamID length type flags
   * ```
   *
   * Where direction is `<<` for inbound and `>>` for outbound.
   *
   * For example, the following would indicate a HEAD request sent from the client.
   * ```
   * `<< 0x0000000f    12 HEADERS       END_HEADERS|END_STREAM
   * ```
   */
  fun frameLog(
    inbound: Boolean,
    streamId: Int,
    length: Int,
    type: Int,
    flags: Int,

How we handle this is [under discussion](https://docs.google.com/document/d/1uM1c3zzoehiijh1ZpZuJ1-SzuVVupenv8r5yuCaFshs/edit#heading=h.dwbqvwmg6ud3).

### Inbound

Traffic entering a pod over HBONE will be handled by the "inbound" code path, on port 15008.

   */
  val sequenceNumber: Int,
  socket: Socket,
  /**
   * The failure MockWebServer recorded when attempting to decode this request. If, for example,
   * the inbound request was truncated, this exception will be non-null.
   */
  val failure: IOException? = null,
) {
  val method: String?
  val path: String?

  /**

  }

  /** Returns the negotiated protocol, or null if no protocol was negotiated. */
  open fun getSelectedProtocol(sslSocket: SSLSocket): String? = null

  /** For MockWebServer. This returns the inbound SNI names. */
  @SuppressLint("NewApi")
  @IgnoreJRERequirement // This function is overridden to require API >= 24.
  open fun getHandshakeServerNames(sslSocket: SSLSocket): List<String> {

        "windowSizeIncrement == 0 || windowSizeIncrement > 0x7fffffffL: $windowSizeIncrement"
      }
      if (logger.isLoggable(FINE)) {
        logger.fine(
          frameLogWindowUpdate(
            inbound = false,
            streamId = streamId,
            length = 4,
            windowSizeIncrement = windowSizeIncrement,
          ),
        )
      }
      frameHeader(
        streamId = streamId,

    messages and `Long.MAX_VALUE` to never compress outbound messages. The default is 1024L which
    compresses messages of size 1 KiB and larger. (Inbound messages are compressed or not based on
    the web socket server's configuration.)
 *  New: Defer constructing `Inflater` and `Deflater` instances until they are needed. This saves

      logger.fine(frameLog(true, streamId, length, TYPE_WINDOW_UPDATE, flags))
      throw e
    }
    if (logger.isLoggable(FINE)) {
      logger.fine(
        frameLogWindowUpdate(
          inbound = true,
          streamId = streamId,
          length = length,
          windowSizeIncrement = increment,
        ),
      )
    }
    handler.windowUpdate(streamId, increment)
  }

- excludeInterfaces
- kubevirtInterfaces
- ISTIO_META_DNS_CAPTURE env variable on the proxy - enables dns redirect
- INVALID_DROP env var on proxy - changes behavior from reset to drop in iptables
- auto excluded inbound ports: 15020, 15021, 15090

The code automatically detects the proxyUID and proxyGID from RunAsUser/RunAsGroup and exclude them from interception, defaulting to 1337

### Overview