{"record":{"id":"75b89f22bb8e3869","repo":"cilium/cilium","slug":"unrecognized-drop-event-version-d","errorCode":null,"errorMessage":"Unrecognized drop event (version %d)","messagePattern":"Unrecognized drop event \\(version (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/monitor/datapath_drop.go","lineNumber":131,"sourceCode":"func (n *DropNotify) dumpIdentity(buf *bufio.Writer, numeric api.DisplayFormat) {\n\tif numeric {\n\t\tfmt.Fprintf(buf, \", identity %d->%d\", n.SrcLabel, n.DstLabel)\n\t} else {\n\t\tfmt.Fprintf(buf, \", identity %s->%s\", n.SrcLabel, n.DstLabel)\n\t}\n}\n\n// Decode decodes the message in 'data' into the struct.\nfunc (n *DropNotify) Decode(data []byte) error {\n\tif l := len(data); l < dropNotifyV1Len {\n\t\treturn fmt.Errorf(\"unexpected DropNotify data length, expected at least %d but got %d\", dropNotifyV1Len, l)\n\t}\n\n\tversion := data[14]\n\n\t// Check against max version.\n\tif version > DropNotifyVersion3 {\n\t\treturn fmt.Errorf(\"Unrecognized drop event (version %d)\", version)\n\t}\n\n\t// Decode logic for version >= v2.\n\tif version >= DropNotifyVersion2 {\n\t\tif l := len(data); l < dropNotifyV2Len {\n\t\t\treturn fmt.Errorf(\"unexpected DropNotify data length (version %d), expected at least %d but got %d\", version, dropNotifyV2Len, l)\n\t\t}\n\t\tn.Flags = data[36]\n\t}\n\n\tif version >= DropNotifyVersion3 {\n\t\tif l := len(data); l < dropNotifyV3Len {\n\t\t\treturn fmt.Errorf(\"unexpected DropNotify data length (version %d), expected at least %d but got %d\", version, dropNotifyV3Len, l)\n\t\t}\n\t\tn.IPTraceID = binary.NativeEndian.Uint64(data[40:48])\n\t}\n\n\t// Decode logic for version >= v0/v1.","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/monitor/datapath_drop.go#L113-L149","documentation":"DropNotify.Decode reads a version byte at offset 14 and supports decoding up to DropNotifyVersion3. If the version byte exceeds that, the message format is unknown to this agent, so Decode rejects it with this error. This guards against misinterpreting fields in a layout the code does not know.","triggerScenarios":"Calling DropNotify.Decode on a payload whose data[14] version byte is > DropNotifyVersion3, e.g. events emitted by a newer BPF datapath decoded by an older agent.","commonSituations":"Upgraded kernels/BPF programs sending newer-format events to an old cilium-agent; mixed-version clusters forwarding events between nodes; replaying captures recorded with a newer version.","solutions":["Upgrade cilium-agent/consumer to a version supporting the new DropNotify version.","Ensure the agent and BPF datapath are deployed from matching versions (rebuild/restart agent after upgrade).","Check for mixed-version nodes in the cluster sharing monitor events.","Pin/downgrade the datapath to the agent's supported version as a temporary measure."],"exampleFix":"// before: old agent decoding v4 events silently/with error\n// after: upgrade agent binary so DropNotifyVersion3 covers (or exceeds) the emitted version\ncilium-cli upgrade --version vX.Y.Z # supports the datapath's drop notify version","handlingStrategy":"try-catch","validationCode":"if len(data) > 14 && data[14] > monitor.DropNotifyVersion3 {\n    return fmt.Errorf(\"unsupported drop event version %d; upgrade cilium\", data[14])\n}","typeGuard":"func isKnownDropVersion(data []byte) bool {\n    return len(data) >= 15 && data[14] <= monitor.DropNotifyVersion3\n}","tryCatchPattern":"err := drop.Decode(data)\nif err != nil {\n    if strings.Contains(err.Error(), \"Unrecognized drop event\") {\n        log.Warn(\"newer drop event version received; upgrade cilium\")\n        return nil\n    }\n    return err\n}","preventionTips":["Upgrade agents before/with the datapath when enabling new drop-notify versions.","Avoid mixed-version clusters forwarding monitor events.","Check cilium release notes for versioned event format changes."],"tags":["monitor","drop-event","version-skew","binary-decoding","cilium"],"backgroundTag":"unsupported-payload-version","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}