diff --git a/ebpf/accesslog.proto b/ebpf/accesslog.proto
index 5678ac1..017b0fd 100644
--- a/ebpf/accesslog.proto
+++ b/ebpf/accesslog.proto
@@ -80,6 +80,27 @@ message AccessLogConnection {
     AccessLogConnectionTLSMode tlsMode = 4;
     // application protocol type
     AccessLogProtocolType protocol = 5;
+    // the attachment information about the connection
+    ConnectionAttachment attachment = 6;
+}
+
+message ConnectionAttachment {
+    // detect contains the environment information
+    oneof environment {
+        // detect the connection have a zTunnel environment(ambient istio)
+        ZTunnelAttachmentEnvironment zTunnel = 1;
+    }
+}
+
+message ZTunnelAttachmentEnvironment {
+    // the real destination ip address of the connection
+    string real_destination_ip = 1;
+    // how the environment detected
+    ZTunnelAttachmentEnvironmentDetectBy by = 2;
+}
+
+enum ZTunnelAttachmentEnvironmentDetectBy {
+    ZTUNNEL_OUTBOUND_FUNC = 0;
 }
 
 message ConnectionAddress {