cilium/cilium · error

Unrecognized drop event (version %d)

Error message

Unrecognized drop event (version %d)

What it means

DropNotify.Decode reads a version byte at offset 14 and supports decoding up to DropNotifyVersion3. If the version byte exceeds that, the message format is unknown to this agent, so Decode rejects it with this error. This guards against misinterpreting fields in a layout the code does not know.

Source

Thrown at pkg/monitor/datapath_drop.go:131

func (n *DropNotify) dumpIdentity(buf *bufio.Writer, numeric api.DisplayFormat) {
	if numeric {
		fmt.Fprintf(buf, ", identity %d->%d", n.SrcLabel, n.DstLabel)
	} else {
		fmt.Fprintf(buf, ", identity %s->%s", n.SrcLabel, n.DstLabel)
	}
}

// Decode decodes the message in 'data' into the struct.
func (n *DropNotify) Decode(data []byte) error {
	if l := len(data); l < dropNotifyV1Len {
		return fmt.Errorf("unexpected DropNotify data length, expected at least %d but got %d", dropNotifyV1Len, l)
	}

	version := data[14]

	// Check against max version.
	if version > DropNotifyVersion3 {
		return fmt.Errorf("Unrecognized drop event (version %d)", version)
	}

	// Decode logic for version >= v2.
	if version >= DropNotifyVersion2 {
		if l := len(data); l < dropNotifyV2Len {
			return fmt.Errorf("unexpected DropNotify data length (version %d), expected at least %d but got %d", version, dropNotifyV2Len, l)
		}
		n.Flags = data[36]
	}

	if version >= DropNotifyVersion3 {
		if l := len(data); l < dropNotifyV3Len {
			return fmt.Errorf("unexpected DropNotify data length (version %d), expected at least %d but got %d", version, dropNotifyV3Len, l)
		}
		n.IPTraceID = binary.NativeEndian.Uint64(data[40:48])
	}

	// Decode logic for version >= v0/v1.

View on GitHub (pinned to ac7b90affa)

Solutions

  1. Upgrade cilium-agent/consumer to a version supporting the new DropNotify version.
  2. Ensure the agent and BPF datapath are deployed from matching versions (rebuild/restart agent after upgrade).
  3. Check for mixed-version nodes in the cluster sharing monitor events.
  4. Pin/downgrade the datapath to the agent's supported version as a temporary measure.

Example fix

// before: old agent decoding v4 events silently/with error
// after: upgrade agent binary so DropNotifyVersion3 covers (or exceeds) the emitted version
cilium-cli upgrade --version vX.Y.Z # supports the datapath's drop notify version
Defensive patterns

Strategy: try-catch

Validate before calling

if len(data) > 14 && data[14] > monitor.DropNotifyVersion3 {
    return fmt.Errorf("unsupported drop event version %d; upgrade cilium", data[14])
}

Type guard

func isKnownDropVersion(data []byte) bool {
    return len(data) >= 15 && data[14] <= monitor.DropNotifyVersion3
}

Try / catch

err := drop.Decode(data)
if err != nil {
    if strings.Contains(err.Error(), "Unrecognized drop event") {
        log.Warn("newer drop event version received; upgrade cilium")
        return nil
    }
    return err
}

Prevention

When it happens

Trigger: Calling DropNotify.Decode on a payload whose data[14] version byte is > DropNotifyVersion3, e.g. events emitted by a newer BPF datapath decoded by an older agent.

Common situations: Upgraded kernels/BPF programs sending newer-format events to an old cilium-agent; mixed-version clusters forwarding events between nodes; replaying captures recorded with a newer version.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/75b89f22bb8e3869. Report an issue: GitHub.