4 ms·

AWS VPC Traffic Mirroring

116 points by jeffbarr 7y ago

teilo 7y ago
It's about time. Finally, IDS/Session monitoring that is external to the hosts one is monitoring.
mlosapio 7y ago
Awesome feature that will likely unlock a bunch of services or service providers like Iceberg, Snort and Suricata to be able to capture and inspect traffic inside the cloud.
- milkshakes 7y ago
  the floodgates are open! my favorite, from the folks behind bro: https://www.corelight.com/company/newsroom/news/corelight-cloud-sensor-for-aws/ https://www.corelight.com/company/newsroom/news/corelight-cl... https://www.corelight.com/products/corelight-sensors/#cloud https://www.corelight.com/products/corelight-sensors/#cloud
gauravphoenix 7y ago
What's really interesting is that you can capture amazon-dns traffic. This is gold for security purposes.
aidos 7y ago
Oh interesting. Could you use this to test a system using live traffic before a release?
- jedberg 7y ago
  I'm pretty sure you could. You could mirror your live traffic to a test, but that's generally a bad idea. You have to make sure no data gets out of your test system either towards the client or towards the database. Gotta be real careful when mirroring real traffic. Of course, using it to capture raw requests and replaying them would be a decent use case.
rawland 7y ago
Slightly off-topic: Amazon Polly breathing in drives me nuts.
- jjeaff 7y ago
  I know, it hasn't improved since they launched it. I feel like an hour or two tweaking it could make it sound fine. I can't believe someone listened to that and said, ya, that sounds really good, let's launch it. Maybe they were using Christopher Reeves as the voice model.
pg_bot 7y ago
This looks really useful. I think you can now offer a full intrusion detection service as a marketplace service on AWS with minimal configuration.
jcims 7y ago
I wonder if this could be used for high availability between two ec2 instances (vrrp/hsrp style)
- not4u2know 7y ago
  VPCs would need to support multicast for VRRP to be an option.
  - skullborg 7y ago
    There are unicast options for VRRP

116 points by jeffbarr 7y ago

It's about time. Finally, IDS/Session monitoring that is external to the hosts one is monitoring.

Awesome feature that will likely unlock a bunch of services or service providers like Iceberg, Snort and Suricata to be able to capture and inspect traffic inside the cloud.

milkshakes 7y ago
the floodgates are open! my favorite, from the folks behind bro: https://www.corelight.com/company/newsroom/news/corelight-cloud-sensor-for-aws/ https://www.corelight.com/company/newsroom/news/corelight-cl... https://www.corelight.com/products/corelight-sensors/#cloud https://www.corelight.com/products/corelight-sensors/#cloud

gauravphoenix 7y ago

What's really interesting is that you can capture amazon-dns traffic. This is gold for security purposes.

aidos 7y ago

Oh interesting. Could you use this to test a system using live traffic before a release?

jedberg 7y ago
I'm pretty sure you could. You could mirror your live traffic to a test, but that's generally a bad idea. You have to make sure no data gets out of your test system either towards the client or towards the database. Gotta be real careful when mirroring real traffic. Of course, using it to capture raw requests and replaying them would be a decent use case.

rawland 7y ago

Slightly off-topic: Amazon Polly breathing in drives me nuts.

jjeaff 7y ago
I know, it hasn't improved since they launched it. I feel like an hour or two tweaking it could make it sound fine. I can't believe someone listened to that and said, ya, that sounds really good, let's launch it. Maybe they were using Christopher Reeves as the voice model.

pg_bot 7y ago

This looks really useful. I think you can now offer a full intrusion detection service as a marketplace service on AWS with minimal configuration.

jcims 7y ago

I wonder if this could be used for high availability between two ec2 instances (vrrp/hsrp style)

not4u2know 7y ago
VPCs would need to support multicast for VRRP to be an option.
- skullborg 7y ago
  There are unicast options for VRRP