fix egress

backend/src/utilities/ebpf_bridge_events.py

@@ -277,6 +277,24 @@ TRACEPOINT_PROBE(skb, kfree_skb) {
   events.perf_submit(args, &event, sizeof(event));
   return 0;
 }
+
+TRACEPOINT_PROBE(net, net_dev_queue) {
+  struct sk_buff *skb = (struct sk_buff *)args->skbaddr;
+  struct event_t event = {};
+  event.ts_ns = bpf_ktime_get_ns();
+  event.event_type = EVENT_EGRESS;
+  event.reason = 0;
+
+  if (!fill_ifname(skb, &event)) {
+    return 0;
+  }
+  if (!parse_skb(skb, &event)) {
+    return 0;
+  }
+
+  events.perf_submit(args, &event, sizeof(event));
+  return 0;
+}
 """
 
 
@@ -386,6 +404,23 @@ def _attach_kprobe_first(bpf: BPF, symbols: list[str], fn_name: str) -> str:
     raise RuntimeError(f"Failed to attach {fn_name} to any of {symbols}")
 
 
+def _attach_egress_probe(bpf: BPF) -> str:
+    symbols = ["__dev_queue_xmit", "dev_queue_xmit"]
+    try:
+        return _attach_kprobe_first(bpf, symbols, "trace_egress")
+    except Exception:
+        pass
+
+    try:
+        bpf.attach_tracepoint(tp="net:net_dev_queue", fn_name="tracepoint__net__net_dev_queue")
+        return "tracepoint:net:net_dev_queue"
+    except Exception as exc:
+        raise RuntimeError(
+            "Failed to attach egress telemetry to any of "
+            f"{symbols} or tracepoint net:net_dev_queue"
+        ) from exc
+
+
 def _parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser(description="eBPF bridge telemetry collector")
     parser.add_argument("--ifaces", required=True, help="Comma-separated list of interfaces to keep")
@@ -413,7 +448,7 @@ def main() -> int:
         ["__netif_receive_skb_core", "netif_receive_skb", "__netif_receive_skb_one_core"],
         "trace_ingress",
     )
-    egress_symbol = _attach_kprobe_first(bpf, ["dev_queue_xmit"], "trace_egress")
+    egress_symbol = _attach_egress_probe(bpf)
 
     print(
         json.dumps(