istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP      
istio.io/telemetry/stats/prometheus/sidecar/Inbound/TCP       
istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP     
istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP      
default.display-metadata                                      envoy.extensions.filters.http.wasm.v3.Wasm

		if filter.Direction != "outbound" {
			for _, c := range wl.Connections.Inbound {
				fmt.Fprintf(w, "%v\tInbound\t%v\t%v\t%v\n", name, lookupIP(c.ActualDst), lookupIP(c.Src), c.OriginalDst)
			}
		}
		if filter.Direction != "inbound" {
			for _, c := range wl.Connections.Outbound {

        },
        {
            "ecdsFilter": {
                "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                "name": "istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP"
            },
            "lastUpdated": "2023-12-23T13:46:00.701Z"
        },
        {
            "ecdsFilter": {
                "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",

  lastUpdated: "2022-12-08T11:03:53.225Z"
  versionInfo: 2022-12-08T09:07:09Z/10
- ecdsFilter:
    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP
  lastUpdated: "2023-12-23T13:46:00.701Z"
- ecdsFilter:
    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP

## Traffic routing

Based on the three [redirection](#redirection) paths, the ztunnel has three primary types of traffic it handles.

### Outbound

Requests leaving a pod go through the "outbound" code path on port 15001.
This is where most of Ztunnel's logic lives.

For outbound traffic, we need to first determine where the traffic is destined to.

                {
                    "ecds_filter": {
                        "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                        "name": "istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP"
                    },
                    "last_updated": "2023-12-23T13:46:00.701Z"
                },
                {
                    "ecds_filter": {

        ],
        "routes": [
         {
          "match": {
           "case_sensitive": true,
           "path_separated_prefix": "/get"
          },
          "route": {
           "cluster": "outbound|8000||httpbin.default.svc.cluster.local",
           "timeout": "0s",
           "retry_policy": {
            "retry_on": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",

	Connections WorkloadConnections `json:"connections,omitempty"`
	Info        WorkloadInfo        `json:"info"`
}

type WorkloadConnections struct {
	Inbound  []InboundConnection  `json:"inbound"`
	Outbound []OutboundConnection `json:"outbound"`
}

type WorkloadInfo struct {
	Name           string `json:"name"`
	Namespace      string `json:"namespace"`
	TrustDomain    string `json:"trustDomain"`

  val sink: BufferedSink,
  val random: Random,
  private val perMessageDeflate: Boolean,
  private val noContextTakeover: Boolean,
  private val minimumDeflateSize: Long,
) : Closeable {
  /** This holds outbound data for compression and masking. */
  private val messageBuffer = Buffer()

  /** The [Buffer] of [sink]. Write to this and then flush/emit [sink]. */
  private val sinkBuffer: Buffer = sink.buffer

	)

	// CLI: -A ISTIO_OUTPUT -m connmark --mark 0x111/0xfff -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
	//
	// DESC: Propagate/restore connmark (if we had one) for outbound
	iptablesBuilder.AppendRule(
		iptableslog.UndefinedCommand, ChainInpodOutput, iptablesconstants.MANGLE,
		"-m", "connmark",
		"--mark", inpodTproxyMark,
		"-j", "CONNMARK",
		"--restore-mark",