{"record":{"id":"7c4406d0c9e7df28","repo":"cilium/cilium","slug":"unable-to-determine-mac-address-of-veth-pair-on-th-7c4406","errorCode":null,"errorMessage":"unable to determine MAC address of veth pair on the container side","messagePattern":"unable to determine MAC address of veth pair on the container side","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/cilium-cni/chaining/generic-veth/generic-veth.go","lineNumber":196,"sourceCode":"\tpeer, err = netlink.LinkByIndex(peerIndex)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"unable to lookup link %d: %w\", peerIndex, err)\n\t\treturn\n\t}\n\n\thostMac, _ = mac.FromHardwareAddr(peer.Attrs().HardwareAddr)\n\tvethHostName = peer.Attrs().Name\n\tvethHostIdx = peer.Attrs().Index\n\n\tswitch {\n\tcase vethHostName == \"\":\n\t\terr = errors.New(\"unable to determine name of veth pair on the host side\")\n\t\treturn\n\tcase !hostMac.IsValid():\n\t\terr = errors.New(\"unable to determine MAC address of veth pair on the host side\")\n\t\treturn\n\tcase !vethLXCMac.IsValid():\n\t\terr = errors.New(\"unable to determine MAC address of veth pair on the container side\")\n\t\treturn\n\tcase vethIP == \"\" && vethIPv6 == \"\":\n\t\terr = errors.New(\"unable to determine IP address of the container\")\n\t\treturn\n\tcase vethHostIdx == 0:\n\t\terr = errors.New(\"unable to determine index interface of veth pair on the host side\")\n\t\treturn\n\t}\n\n\tvar disabled = false\n\tep := &models.EndpointChangeRequest{\n\t\tAddressing: &models.AddressPair{\n\t\t\tIPv4: vethIP,\n\t\t\tIPv6: vethIPv6,\n\t\t},\n\t\tContainerID:            pluginCtx.Args.ContainerID,\n\t\tState:                  models.EndpointStateWaitingDashForDashIdentity.Pointer(),\n\t\tHostMac:                hostMac,","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/plugins/cilium-cni/chaining/generic-veth/generic-veth.go#L178-L214","documentation":"During CNI ADD the plugin validates the container-side veth MAC (vethLXCMac). If it is invalid, Cilium cannot register the endpoint with the agent because endpoint identity/monitoring relies on the container MAC. ADD is aborted before the EndpointChangeRequest is sent.","triggerScenarios":"In generic-veth.go Add(): the container-side interface's hardware address failed mac.IsValid() — e.g. the netlink link for the container interface has no hardware address.","commonSituations":"Custom runtimes or nested containers presenting interfaces without MACs; misconfigured chaining where an earlier plugin already altered the link; concurrent link modification during ADD.","solutions":["Retry the pod schedule; transient link states often resolve.","Verify the CNI chain configuration so cilium-cni runs against a standard veth-based interface.","Check that no mutating plugin (e.g. macvlan/bond setup) precedes the cilium chain step and strips the MAC.","Capture netlink state at failure time via CNI debug logs."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure cilium-cni runs against a standard veth-based interface in the CNI chain.","Avoid chained plugins that mutate the container interface MAC.","Keep runtime/CNI versions aligned and retry transient link-state races."],"tags":["cni","network","veth","mac-address"],"backgroundTag":"veth-peer-resolution-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}