@maxbischoff what are your thoughts here:

theoretically if we have a network policy like this:

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: web-deny-all
  namespace: 01-deny-all-traffic-to-an-application
spec:
  podSelector:
    matchLabels:
      app: web
  ingress: []

We would need to check also UDP since the docs tell us:

   ports        <[]Object>
     List of ports which should be made accessible on the pods selected for this
     rule. Each item in this list is combined using a logical OR. If this field
     is empty or missing, this rule matches all ports (traffic not restricted by
     port). If this field is present and contains at least one item, then this
     rule allows traffic only if the traffic matches at least one port in the
     list.

If we test both this could introduce some noise (since most services will only be listening on TCP) but for completeness we actually should check the UDP ports also otherwise we could ignore an open protocol.

@maxbischoff what are your thoughts here:

theoretically if we have a network policy like this:

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: web-deny-all
  namespace: 01-deny-all-traffic-to-an-application
spec:
  podSelector:
    matchLabels:
      app: web
  ingress: []

We would need to check also UDP since the docs tell us:

   ports        <[]Object>
     List of ports which should be made accessible on the pods selected for this
     rule. Each item in this list is combined using a logical OR. If this field
     is empty or missing, this rule matches all ports (traffic not restricted by
     port). If this field is present and contains at least one item, then this
     rule allows traffic only if the traffic matches at least one port in the
     list.

If we test both this could introduce some noise (since most services will only be listening on TCP) but for completeness we actually should check the UDP ports also otherwise we could ignore an open protocol.

I think we should factor it in. Maybe we can make UDP testing (or the tested protocols) configurable in general?

For the configurable part I would open a second PR once UDP support is finished.