The ordering is now consistent across inbound, outbound and gateway proxy modes, as well as HTTP and TCP protocols:
      
      * Metadata Exchange
      * CUSTOM Authz
      * WASM Authn
      * Authn
      * WASM Authz
      * Authz
      * WASM Stats
      * Stats
      * WASM unspecified
      
      This changes the following areas:
      * Inbound TCP filters now place Metadata Exchange before Authn.

				cfg.OutboundIPRangesInclude = "10.0.0.0/8"
			},
		},
		{
			"inbound-ports-include",
			func(cfg *config.Config) {
				cfg.InboundPortsInclude = "32000,31000"
			},
		},
		{
			"inbound-ports-wildcard",
			func(cfg *config.Config) {
				cfg.InboundPortsInclude = "*"
			},
		},
		{
			"inbound-ports-tproxy",
			func(cfg *config.Config) {
				cfg.InboundPortsInclude = "32000,31000"

	ExcludeInboundPort      = Command{"ExcludeInboundPort", "exclude inbound port from capture"}
	IncludeInboundPort      = Command{"IncludeInboundPort", "include inbound port for capture"}
	InboundCapture          = Command{"InboundCapture", "redirect inbound request to proxy"}
	KubevirtCommand         = Command{"KubevirtCommand", "Kubevirt outbound redirect"}

# Comma separated list of local ports that will use Istio sidecar for inbound services.
# If set, iptables rules will be configured to intercept inbound traffic and redirect to sidecar.
# If not set, no rules will be enabled
# ISTIO_INBOUND_PORTS=

# List of ports to exclude from inbound interception, if ISTIO_INBOUND_PORTS is set to *
# Port 22 is automatically excluded
# ISTIO_INBOUND_EXCLUDE_PORTS=

   * direction streamID length type flags
   * ```
   *
   * Where direction is `<<` for inbound and `>>` for outbound.
   *
   * For example, the following would indicate a HEAD request sent from the client.
   * ```
   * `<< 0x0000000f    12 HEADERS       END_HEADERS|END_STREAM
   * ```
   */
  fun frameLog(
    inbound: Boolean,
    streamId: Int,
    length: Int,
    type: Int,
    flags: Int,

		// Inbound clusters don't have svchost in its format. So don't add it to serviceClusters.
		if dir == model.TrafficDirectionInbound {
			// Append all inbound clusters because in both stow/delta we always build all inbound clusters.
			// In reality, the delta building is only for outbound clusters. We need to revist here once we support delta for inbound.

Ben Leggett <******@****.***> 1710179183 -0400

		{Name: "inbound|9999||mgmtCluster"},
	}
	sidecarInboundOut := []*cluster.Cluster{
		{Name: "cluster1", DnsLookupFamily: cluster.Cluster_V6_ONLY, LbPolicy: cluster.Cluster_RING_HASH},
	}

	sidecarInboundServiceIn := []*cluster.Cluster{
		{Name: "inbound|7443||", DnsLookupFamily: cluster.Cluster_V4_ONLY, LbPolicy: cluster.Cluster_ROUND_ROBIN},
	}

                "name": "istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP"
            },
            "lastUpdated": "2023-12-23T13:46:00.708Z"
        },
        {
            "ecdsFilter": {
                "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                "name": "istio.io/telemetry/stats/prometheus/sidecar/Inbound/TCP"
            },
            "lastUpdated": "2023-12-23T13:46:00.707Z"

                {
                    "ecds_filter": {
                        "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                        "name": "istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP"
                    },
                    "last_updated": "2023-12-23T13:46:00.708Z"
                }
            ]
        },
        {