{"record":{"id":"f3722a9ae5a3fd70","repo":"cilium/cilium","slug":"retrieving-device-s-w-f3722a","errorCode":null,"errorMessage":"retrieving device %s: %w","messagePattern":"retrieving device (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/loader/netlink.go","lineNumber":532,"sourceCode":"\t\treturn nil\n\t}\n\n\tif err := netlink.LinkSetName(link, to); err != nil {\n\t\treturn fmt.Errorf(\"renaming device %s to %s: %w\", from, to, err)\n\t}\n\n\treturn nil\n}\n\n// DeviceHasSKBProgramLoaded returns true if the given device has a tc(x) program\n// attached.\n//\n// If checkEgress is true, returns true if there's both an ingress and\n// egress program attached.\nfunc DeviceHasSKBProgramLoaded(device string, checkEgress bool) (bool, error) {\n\tlink, err := safenetlink.LinkByName(device)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"retrieving device %s: %w\", device, err)\n\t}\n\n\titcx, err := hasCiliumTCXLinks(link, ebpf.AttachTCXIngress)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"failed to check for cilium tcx links on ingress: %w\", err)\n\t}\n\titc, err := hasCiliumTCFilters(link, netlink.HANDLE_MIN_INGRESS)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"failed to check for cilium tc filters on ingress: %w\", err)\n\t}\n\tink, err := hasCiliumNetkitLinks(link, ebpf.AttachNetkitPeer)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"failed to check for cilium netkit links: %w\", err)\n\t}\n\n\t// Need ingress programs at minimum, bail out if these are already missing.\n\tif !itc && !itcx && !ink {\n\t\treturn false, nil","sourceCodeStart":514,"sourceCodeEnd":550,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/loader/netlink.go#L514-L550","documentation":"DeviceHasSKBProgramLoaded looks up the given network device to inspect whether a Cilium BPF program is attached; the safenetlink.LinkByName lookup itself failed, so attachment state could not be determined. This wraps the underlying netlink error (typically ENODEV).","triggerScenarios":"Calling DeviceHasSKBProgramLoaded with a device name that does not exist in the current network namespace, a misspelled interface name, or when the device was removed after configuration was generated (device list out of sync).","commonSituations":"CiliumConfig devices changed (e.g. enp5s0 renamed to eth0 after reboot or by predictable-naming), datapath reload running in the wrong netns (e.g. inside a container instead of host), or veth devices torn down by pod deletion.","solutions":["Verify the device exists: ip link show <device> in the same netns the agent runs in.","Update the devices list in the CiliumConfig to match current interface names (device renames after reboot are common).","If running from a test/tool, execute in the host network namespace (nsenter -t 1 -n) rather than a container netns.","Re-run the check after the agent re-syncs its device list; transient ENODEV during pod teardown usually self-heals."],"exampleFix":"// before\nloaded, err := DeviceHasSKBProgramLoaded(\"eno1\", true)\n// after: guard the lookup\nif _, err := net.InterfaceByName(\"eno1\"); err != nil {\n\treturn fmt.Errorf(\"device eno1 not present: %w\", err)\n}\nloaded, err := DeviceHasSKBProgramLoaded(\"eno1\", true)","handlingStrategy":"validation","validationCode":"if _, err := net.InterfaceByName(device); err != nil {\n\treturn fmt.Errorf(\"device %q not present in this netns: %w\", device, err)\n}\nloaded, err := loader.DeviceHasSKBProgramLoaded(device, true)","typeGuard":"func deviceExists(name string) bool {\n\t_, err := net.InterfaceByName(name)\n\treturn err == nil\n}","tryCatchPattern":"loaded, err := loader.DeviceHasSKBProgramLoaded(\"eth0\", true)\nif err != nil {\n\tvar eno unix.Errno\n\tif errors.As(err, &eno) && eno == unix.ENODEV {\n\t\tlog.Printf(\"device missing; re-syncing Cilium device config\")\n\t}\n\treturn err\n}","preventionTips":["Keep the devices list in CiliumConfig in sync with actual interface names, especially after reboots/renames.","Run inspection tools in the host network namespace (nsenter -t 1 -n).","Check `ip link show <device>` before invoking datapath inspection APIs.","Use stable interface names (netplan/ifcfg) to avoid predictable-naming drift."],"tags":["network","netlink","bpf","cilium"],"backgroundTag":"network-device-not-found","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}