Introduction

Returns a synthesized HTTP response for a specific dependency's cleartext HTTP calls — a status code, and optionally a custom body and headers — without ever reaching the real dependency. Requests are matched by the HTTP Host header. This is cleartext HTTP only; HTTPS cannot be intercepted at layer 7 without breaking TLS, so for HTTPS dependencies use the L7 mode of Reset TCP/HTTP(s) Connection instead.

Prerequisites

If you are not using our container images for the extension, the attack requires iptables (from the iptables package).

The target container must not share the host's network namespace. Containers using host networking are skipped by default (see the Fail on Host Network parameter).

Details

A transparent TCP proxy is started in the container's network namespace. An iptables rule redirects matching outgoing TCP connections to the proxy, which reads the HTTP Host header to decide whether a request belongs to one of the targeted dependencies. Requests to other destinations are relayed through untouched. Because selection happens by hostname rather than by IP, the attack works for dependencies behind shared or rotating IPs (CDNs, cloud endpoints). Each execution uses its own iptables chain, so multiple attacks can run concurrently. For matched requests the proxy writes the configured HTTP status code (and optional body and headers) back to the client instead of forwarding the request. Because it operates on cleartext HTTP, it defaults to port 80.

Only cleartext HTTP traffic to the targeted hostname(s) is affected. Other traffic in the container is relayed untouched. HTTPS is not intercepted; to disrupt an HTTPS dependency use the L7 mode of Reset TCP/HTTP(s) Connection.

Intercepting every port

With Dependency Ports left empty, every outgoing TCP connection of the container passes through the proxy during the attack; localhost traffic is excluded unless Attack Localhost Traffic is enabled (see below). Cleartext HTTP requests to the dependency hostnames are recognized on any port by their Host header and answered with the configured response; everything else, including HTTPS, is relayed untouched.

Localhost traffic

By default, localhost traffic (127.0.0.0/8) in the target's network namespace is never intercepted, whether or not Dependency Ports are set. Enable Attack Localhost Traffic to intercept it as well, e.g. when the application reaches the dependency through a local forward proxy or a 127.x entry in /etc/hosts. As all containers of a Kubernetes Pod share the network namespace, this includes traffic between them over localhost.

• Matching localhost connections pass through the proxy: existing ones may be reset when the attack starts, and all of them are closed when it ends. Without Dependency Ports, this applies to all localhost traffic in the pod, including sidecars such as service mesh proxies. Use Dependency Ports to narrow it down.
• Only IPv4 localhost is intercepted; ::1 is not affected.
• If a hostname seems to point to localhost, the attack warns but still runs.
• If the target container uses the host network, the option intercepts the host's localhost traffic (e.g. probes or agents on 127.0.0.1), except the extension's own ports. Use Fail on Host Network to prevent this.
• Earlier versions intercepted localhost only when Dependency Ports were set.

Use Cases

• Simulate a dependency returning 5xx errors and verify error handling and fallbacks
• Force specific status codes (e.g. 429, 503) to test retry, backoff and circuit-breaker logic
• Return a crafted body or headers to exercise response parsing and validation

Protocol compatibility

• HTTP/1.0 and HTTP/1.1 (cleartext) — matched by the HTTP Host header and the synthesized response is written back. Fully supported. Percentage applies per request: each request on a keep-alive connection is decided on its own, and the connection stays open after a synthesized response. A WebSocket upgrade is decided on the upgrade request only; after that, the connection is passed through untouched.
• HTTPS (TLS), any HTTP version — not supported: a synthesized HTTP response cannot be returned inside TLS without terminating it. Use Slow Outgoing HTTP(s) Dependency or the L7 mode of Reset TCP/HTTP(s) Connection for HTTPS dependencies.
• HTTP/2 cleartext (h2c) — not matched (the authority is not a plain Host header).
• HTTP/3 (QUIC) — not affected: this attack intercepts TCP only.

Parameters

Statistics

While the attack runs, a Dependency Fault Statistics widget shows the intercepted ports, how many connections were intercepted, how many of them went to a dependency hostname and how many were faulted, a breakdown of what was done (latency applied, HTTP responses injected, connections reset, forwarded untouched), and a per-hostname table. Zero intercepted connections means the interception installed but no traffic hit it — check the ports and that traffic flows through this network namespace. Intercepted connections but none to a dependency hostname means the traffic flows, but the hostnames don't match — check them against the TLS SNI or HTTP Host header. For cleartext HTTP, the summary shows requests instead of connections: how many went to a dependency hostname and how many were faulted, with the share in percent to compare with Percentage. The per-hostname table shows both, and there a keep-alive connection counts as faulted once, however many of its requests were. If the proxy can't connect to a destination, the widget shows how often forwarding failed. HTTP responses injected counts every synthesized response.