Description

In scenarios where an incoming HTTP request contains a large volume of header data (e.g., extensive Cookie or User-Agent headers), the eBPF instrumentation fails to extract the existing traceparent.

If the traceparent is located deep in the header block at an offset exceeding the number of bytes captured by the eBPF program, the instrumentation fails to find the context and generates a new trace_id. This creates a "trace break" in distributed tracing.

Steps to Reproduce

• Send an HTTP request to an instrumented service.
• Populate the request with several large headers (e.g., a massive Cookie) before the traceparent header.
• Ensure the cumulative size of headers preceding traceparent exceeds the internal capture buffer (e.g., several thousand bytes).
• Observe the exported spans.

Expected Behavior

The eBPF agent should be able to scan the full header block or provide a configurable offset/buffer size to ensure traceparent discovery, even in requests with large metadata.

Actual Behavior

The agent only inspects the first N bytes of the request. If traceparent is located at an offset greater than N bytes, it is ignored, and a new trace is started.

Environment

OS: Ubuntu 22.04.5 LTS - Kernel 6.8.0-101-generic
Agent Version: v0.5.0