Node state

Node state is what a node’s data plane actually holds: the networks it routes, where it delivers traffic, the services and policy it enforces, and live connection state. It lives inside the node’s lace-node pod — reach it with lace exec:

lace exec --node worker-3 -- node bpf show routing

The examples below show the forwarded node … command; prefix each with lace exec --node <name> --. Flags that apply to the node command go after --:

• -n, --numeric — print raw IDs and addresses without contacting the API server. Use this when name resolution fails or the API server is unreachable.
• --limit <n> — cap the number of entries shown.

BPF maps

node bpf show <map> dumps one map at a time:

Map	Shows
config	the node’s own locator prefix
devices	managed interfaces and their MAC addresses
routing	which destination network a flow is routed into, and whether it is masqueraded
delivery	how a destination prefix is delivered (local pod, remote node, host)
veth	each pod interface, its network, and source segment
services	service VIPs and the source networks they serve; add --endpoints for backends
policy	the resolved allow rules between segments; narrow with --egress or --ingress
segment	the segment each endpoint resolves to
prefix-segment	the segment each prefix resolves to
probes	configured pod probe targets
probe-cookie	in-flight probe connections and their original destination

When traffic is wrongly allowed or denied, resolve the endpoints to their segments (segment, prefix-segment) and check the rules programmed between them (policy).

Connection tracking

node ct list <table> lists live conntrack entries; node ct gc <table> removes expired ones. The table is one of all, ct-tcp-v6, ct-udp-v6, ct-icmp-v6, ct-tcp-v4, ct-udp-v4, ct-icmp-v4.

Flow traces

node trace flow streams each flow’s final accept/deny decision — the full tuple, NAT result, and delivery method — as the data plane makes it. This is the first place to look when a packet is dropped or delivered to the wrong place.

Devices

node device list lists the node’s interfaces and which BPF programs are attached to each, to confirm the data plane is hooked in where expected.