---
title: "Linkerd Protocol Detection"
url: https://daily.dev/posts/linkerd-protocol-detection-o3rb9xyvu
source_url: https://linkerd.io/2026/02/09/linkerd-protocol-detection
type: article
source: "Linkerd"
published: 2026-08-23T12:23:32.604Z
updated: 2026-08-23T12:54:26.771Z
tags: ["kubernetes", "infrastructure", "networking", "grpc", "service-mesh"]
reading_time: 8
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Linkerd Protocol Detection

**[Linkerd](https://daily.dev/sources/linkerd)** · 8 min read · 0 upvotes · 0 comments

## Summary

Explains how Linkerd automatically identifies connection protocols (HTTP, HTTP/2, gRPC, TLS) by inspecting the first bytes of a connection, avoiding manual configuration. Covers detection timeouts, marking ports as opaque for non-detectable protocols like MySQL and Redis, handling server-first protocols such as SMTP and SSH, troubleshooting common detection issues with CLI commands, and best practices like naming ports and pre-configuring opaque ports for known services.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://linkerd.io/2026/02/09/linkerd-protocol-detection>

## Questions this post answers

### Why is my MySQL connection through Linkerd hanging indefinitely?

MySQL is a server-first protocol, meaning the server sends data before the client does, so Linkerd's proxy waits for client data that never arrives and the connection hangs. Mark the MySQL port as opaque using the config.linkerd.io/opaque-ports annotation (e.g., set to "3306") to skip protocol detection entirely for that port.

_Debugging service mesh networking issues gets easier with troubleshooting guides surfaced on daily.dev._

### How does Linkerd know whether a connection is HTTP, gRPC, or TCP without configuration?

Linkerd peeks at the first bytes of an incoming connection and matches them against known signatures: HTTP/1.x starts with a method like GET or POST, HTTP/2 starts with the connection preface "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", gRPC is HTTP/2 with a content-type: application/grpc header, TLS starts with a ClientHello, and anything unmatched falls back to plain TCP.

_Understanding how service meshes classify traffic helps when comparing options on daily.dev._

### Which ports should be marked as opaque in a Linkerd service mesh?

Ports serving protocols that cannot be detected should be marked opaque, including server-first protocols like MySQL, SMTP, FTP, and SSH, plus other binary protocols like Redis and MongoDB. Use the config.linkerd.io/opaque-ports annotation with a comma-separated port list, e.g. "3306,6379,27017", applied at the service, deployment, or namespace level.

_Keep configuration patterns like this handy while managing service mesh setups via daily.dev._

---

Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#infrastructure](https://daily.dev/tags/infrastructure), [#networking](https://daily.dev/tags/networking), [#grpc](https://daily.dev/tags/grpc), [#service-mesh](https://daily.dev/tags/service-mesh)

[View this post on daily.dev](https://daily.dev/posts/linkerd-protocol-detection-o3rb9xyvu)