From 1d7ca17c3ecc3c38a7e4cbd27fbd7ee6dcc1e022 Mon Sep 17 00:00:00 2001
From: Simon Howe <footless@gmail.com>
Date: Fri, 24 Jul 2020 15:01:45 +0200
Subject: [PATCH] Improve Monitor function description

---
 net/iptables.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/iptables.go b/net/iptables.go
index ba555e0d..315fac02 100644
--- a/net/iptables.go
+++ b/net/iptables.go
@@ -130,7 +130,9 @@ const (
 	iptablesFlushPollTime = 100 * time.Millisecond
 )
 
-// Monitor is part of Interface
+// Monitor periodically checks for a canary chain in iptables. If this canary chain goes missing it calls the reloadFunc.
+// This is a more efficient way of detecting whether firewalld or another process has been removing rules that we rely on.
+// The reloadFunc can then check whether other chains that should exist are still there, fix things and restore the canary.
 func Monitor(log *logrus.Logger, canary string, tables []string, reloadFunc func(), interval time.Duration, stopCh <-chan struct{}) {
 	ipt, err := iptables.New()
 	if err != nil {