Dependency Discovery and Reliability Management

In the context of Gremlin Reliability Management, Dependency Discovery uses DNS and socket data gathered by the Gremlin Agent, specifically traffic involving DNS queries on port 53.

For Dependency Discovery to function correctly, the agent must be installed with collect_dns: true and hostNetwork: true. Both settings are enabled by default in current versions of the Gremlin Agent. Additionally, the Linux agent requires the NET_RAW capability (also enabled by default in the Helm chart). On Windows, the packet capture kernel module must be installed.

Once these prerequisites are met, the following conditions must also be true:

1. A process within the subject service performs a DNS lookup
2. A connection is opened to the IP address returned by that lookup
3. These events occur on more than one host running the subject service

Multiple hosts are required before a dependency is established. This helps reduce false positives caused by host-specific traffic generated by system services and daemons such as package managers, DHCP clients, and NTP services.

Further reading:

https://www.gremlin.com/docs/reliability-management-dependencies#toc-how-dependency-detection-works