Introduction

Adds latency to calls to a specific dependency, identified by hostname at layer 7 (TLS SNI / HTTP Host). Unlike Network Delay, which slows all traffic to an IP or CIDR, this slows only the traffic to the named dependency — and it works over HTTPS and for endpoints served by shared or rotating IPs.

Prerequisites

If you are not using our container images for the extension, the attack requires iptables (from the iptables package).

Details

A transparent TCP proxy is started in the host's network namespace. An iptables rule redirects matching outgoing TCP connections to the proxy, which inspects the connection at layer 7 — reading the TLS ClientHello SNI for HTTPS or the HTTP Host header for cleartext — to decide whether it belongs to one of the targeted dependencies. Connections to other destinations are relayed through untouched, so only traffic to the named hostname(s) is affected. Because selection happens by hostname rather than by IP, the attack works for dependencies behind shared or rotating IPs (CDNs, cloud endpoints) and over HTTPS. Each execution uses its own iptables chain, so multiple attacks can run concurrently. Over HTTPS, a matched connection is held for the configured latency before it connects to the real destination. Over cleartext HTTP, the delay is added before each selected request is forwarded.

Only TCP traffic to the targeted hostname(s) is affected. Other traffic on the host is relayed untouched.

Intercepting every port

With Dependency Ports left empty, every outgoing TCP connection of the host passes through the proxy during the attack; localhost traffic is excluded unless Attack Localhost Traffic is enabled (see below). This includes system services such as the kubelet and the container runtime. The fault still applies only to connections to the dependency hostnames, everything else is relayed untouched. Because HTTP is recognized on any port by its Host header and TLS by its SNI, other protocols over TLS whose SNI matches a dependency hostname (e.g. Kafka or Redis over TLS) are affected too. Protocols that switch to TLS mid-connection (Postgres, MySQL, SMTP STARTTLS) are not recognized and are relayed untouched.

Localhost traffic

By default, localhost traffic (127.0.0.0/8) on the host is never intercepted, whether or not Dependency Ports are set. Enable Attack Localhost Traffic to intercept it as well, e.g. when the application reaches the dependency through a local forward proxy or a 127.x entry in /etc/hosts.

• Matching localhost connections pass through the proxy: existing ones may be reset when the attack starts, and all of them are closed when it ends. Without Dependency Ports, this applies to all localhost traffic on the host, including local agents and sidecars. Use Dependency Ports to narrow it down.
• Only IPv4 localhost is intercepted; ::1 is not affected.
• If a hostname seems to point to localhost, the attack warns but still runs.
• The extension's own ports stay excluded, so the attack can still be stopped.
• Earlier versions intercepted localhost only when Dependency Ports were set.

Use Cases

• Simulate a slow third-party API or downstream service and verify client timeouts and retries
• Validate SLOs and fallbacks when one dependency degrades while the rest of the network is healthy
• Test connection-pool and circuit-breaker behavior under sustained dependency latency

Protocol compatibility

Selection happens at layer 7, so which protocols are affected depends on how the dependency is reached:

• HTTP/1.0 and HTTP/1.1 (cleartext) — matched by the HTTP Host header. Fully supported. Percentage applies per request: each request on a keep-alive connection is decided on its own, and the delay is added before that request is forwarded.
• HTTPS (TLS), including HTTP/1.1 and HTTP/2 over TLS — matched by the TLS SNI. Supported: the fault acts at the connection level and does not need to read inside TLS. Percentage applies per connection, and the latency is added once, when the connection opens: later requests on a keep-alive connection are not delayed. With pooled clients the attack mostly slows new connections; Reset existing connections makes pooled clients reconnect at the start, but each new connection is still slowed only once.
• HTTP/2 cleartext (h2c) — not matched: there is no SNI and the authority is carried in an HPACK-compressed HEADERS frame rather than a plain Host header. (h2c is rare in practice.)
• HTTP/3 (QUIC) — not affected: QUIC runs over UDP and this attack intercepts TCP only. Disable HTTP/3/QUIC on the client, or target the TCP fallback, to exercise the dependency.

Parameters

Statistics

While the attack runs, a Dependency Fault Statistics widget shows the intercepted ports, how many connections were intercepted, how many of them went to a dependency hostname and how many were faulted, a breakdown of what was done (latency applied, HTTP responses injected, connections reset, forwarded untouched), and a per-hostname table. Zero intercepted connections means the interception installed but no traffic hit it — check the ports and that traffic flows through this network namespace. Intercepted connections but none to a dependency hostname means the traffic flows, but the hostnames don't match — check them against the TLS SNI or HTTP Host header. For cleartext HTTP, the summary shows requests instead of connections: how many went to a dependency hostname and how many were faulted, with the share in percent to compare with Percentage. The per-hostname table shows both, and there a keep-alive connection counts as faulted once, however many of its requests were. If the proxy can't connect to a destination, the widget shows how often forwarding failed.