# Egress

> How outbound traffic leaves from an agent's own IPv6 address: the connectivity tiers, the bound proxy, the egress bearer, and the keyless source echo.

*Source: https://www.whisper.security/docs/network/egress*

---
Outbound traffic from an agent can leave the internet from the agent's own address
instead of from whatever address its host happens to have. The far end then sees a
source it can look up, with no agreement and no key on its side.

```bash
whisper connect --agent shipping-bot
whisper run curl -s https://rdap.whisper.online/egress-ip
{"ip":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}
```

There is more than one way to get there, and they differ in what they ask of the host:
[Connectivity Tiers](/docs/network/egress/tiers) lays them side by side and says which
one a rootless container, a bare-metal host or a browser automation runner should take.
The job itself, from install to a proven source address, is
[Send Traffic From Your Address](/docs/network/egress/connect).

The credential the proxy accepts, and what it is bound to, is on
[Egress Authentication](/docs/network/egress/auth). Read it before you put a bearer in a
deployment secret.

Two cases need their own page. A function runtime that offers `fetch` and no raw sockets
goes through an HTTPS relay instead of a tunnel, covered in
[Serverless and Edge Runtimes](/docs/network/egress/serverless). And a destination that
answers only on the older protocol sees something different from one that speaks IPv6,
which [Reaching IPv4 Destinations](/docs/network/egress/ipv4) sets out.