Need help to understand adv_forward_bytes metric

[oleksiytsyban]

Please help me with metric understanding.

Retina 0.0.20 installed in AWS EKS Kubernetes cluster in Advanced Remote Context mode.
I am doing a simple Prometheus request:

increase(networkobservability_adv_forward_bytes{destination_ip="10.10.11.1", source_ip="10.10.22.15"}[1h])

Where destination_ip is a node IP and source_ip is an internal registry pod IP. The registry pod is running on "ip-10-10-22-220" node. So the node is downloading images from the registry and I am trying to count how much.

And the result is:

{destination_ip="10.10.11.1", destination_namespace="unknown", destination_podname="unknown", destination_workload_kind="unknown", destination_workload_name="unknown", direction="EGRESS", instance="ip-10-10-11-1", job="retina-svc", source_ip="10.10.22.15", source_namespace="registry", source_podname="docker-registry-76b7746c8c-n7q6n", source_workload_kind="ReplicaSet", source_workload_name="docker-registry-76b7746c8c"}
344945
{destination_ip="10.10.11.1", destination_namespace="unknown", destination_podname="unknown", destination_workload_kind="unknown", destination_workload_name="unknown", direction="EGRESS", instance="ip-10-10-22-220", job="retina-svc", source_ip="10.10.22.15", source_namespace="registry", source_podname="docker-registry-76b7746c8c-n7q6n", source_workload_kind="ReplicaSet", source_workload_name="docker-registry-76b7746c8c"}
188
{destination_ip="10.10.11.1", destination_namespace="unknown", destination_podname="unknown", destination_workload_kind="unknown", destination_workload_name="unknown", direction="INGRESS", instance="ip-10-10-11-1", job="retina-svc", source_ip="10.10.22.15", source_namespace="registry", source_podname="docker-registry-76b7746c8c-n7q6n", source_workload_kind="ReplicaSet", source_workload_name="docker-registry-76b7746c8c"}
22686
{destination_ip="10.10.11.1", destination_namespace="unknown", destination_podname="unknown", destination_workload_kind="unknown", destination_workload_name="unknown", direction="INGRESS", instance="ip-10-10-22-220", job="retina-svc", source_ip="10.10.22.15", source_namespace="registry", source_podname="docker-registry-76b7746c8c-n7q6n", source_workload_kind="ReplicaSet", source_workload_name="docker-registry-76b7746c8c"}
367112

As I understand, EGRESS instance="ip-10-10-11-1" is incoming traffic to the destination node, INGRESS instance="ip-10-10-22-220" is the same traffic, outgoing from the source node. But the numbers are different. Why?
And INGRESS, instance="ip-10-10-11-1" and EGRESS, instance="ip-10-10-22-220" are impossible combinations, but the numbers are far from zero.

[SRodi]

@alexcastilio