Function attach_tcp_filter 

pub(crate) fn attach_tcp_filter(
    socket: &Socket,
    sport: u16,
    is_ipv6: bool,
) -> Result<()>

Attach a filter to a raw TCP socket so the kernel only delivers TCP segments with the RST flag set whose destination port matches sport (the worker’s source port), dropping all other TCP traffic — which on a raw TCP socket includes a copy of every TCP segment on the host (SSH, the gRPC control connection to the orchestrator, etc.).

Arguments

• socket - the raw TCP socket to attach the filter to
• sport - the worker’s source port (TCP replies carry it as their dport)
• is_ipv6 - whether this is an IPv6 socket