Hey, everyone, and welcome back.
Now, in today's video, we are going to discuss about traffic mirroring.
Now, many of the organizations generally have requirements related to capturing the network traffic
for various use cases.
It can be related to ideas, IP, asylum and so on.
So what they generally used to do was they used to install some kind of wire data collection tools like
Splunk Stream that would capture certain type of network traffic to analyze them for security threats.
So let me also show you.
So in the Splunk base year, you have a Splunk app for stream and within you could capture a lot of
protocols.
It could be a HTTP protocol, DNS protocol and various others.
And within that protocol also, you could define what are the exact things that you need within the
captured and based on which the agent used to capture those details.
So although this is one of the great apps that allows the network traffic capture based on a specific
filter, but one of the disadvantages that you will generally see not only related to Splunk Stream,
but also related to other network traffic capture, is associated with a system performance.
Now, I remember in the organization that I used to work with, we used to have hundreds of instances
and I was generally responsible for Splunk Stream that I was taking care of the Splunk deployment for
the entire organization.
Now all those Splunk stream was good, but one of the repeated issues that we used to face was related
to the performance.
You could say that I was during that time part of both the security as well as the team, because the
Splunk stream sometimes used to slow down the overall system and also the application, and then we
had to look into it and fix the issue accordingly.
So what are the alternatives that device has released to capture the network?
Traffic of the AC two instance is the traffic mirroring feature.
So at a high level overview, the traffic mirroring is an Amazon VPC feature that you can use to copy
the network traffic from an elastic network interface.
So this can be understood with this diagram where you have a set of AC two instances and this easy to
instances would have some kind of network interface and the traffic mirroring would allow us to copy
the network traffic that is associated with the network interface and send it to a centralized monitoring
instance.
So this centralized monitoring instance could be a Splunk instance, it could be a IDs IP system and
so on.
So no longer you have to install the agent individually in the AC two instance to capture the network
traffic, you can directly make use of traffic mirroring.
So this is the high level overview.
Let's go ahead and have a quick demo.
So for today's demo, I have three AC, two instances.
One is the client, second is the server, and third is the monitoring tool.
So what we will be doing from the client over here, we will be sending the traffic to the server and
we will be looking into the monitoring tool to verify if this traffic from the client to server was
captured.
Now I already have the traffic mirroring that is already set up between these servers.
So ideally the network traffic should be captured.
So currently within this CLE, I have two tabs that are open.
One is associated with the client that will be sending some traffic to the server.
And the second tab is related to our monitoring tool that we'll be using to capture the traffic that
is reaching the server.
Now from the monitoring tool will be running the TCP command to go ahead and capture a specific traffic.
Now, at this stage, you will see that there is no traffic that is being seen in a dump.
So let's do one thing.
Let's copy the IP address associated with the server and from the client machine.
I'll send a simple request to this specific IP address.
So I already have a HTTP server that is running on the server based easy to.
Now at this stage, if you will see there is still no traffic in the monitoring tool.
But as soon as I run the command, you see immediately a set of traffic was captured at a monitoring
server level.
All right.
So just to revise from the client, we made a request to the server IP and a traffic mirroring was capturing
the traffic that was coming to the server and it is forwarding that traffic to our monitoring tool from
which it can be analyzed.
Now, let me also quickly show you on how that would look like in the traffic mirroring feature.
So if you see I have one traffic mirroring session and the source here is a specific network interface.
As we are discussing over here, the traffic mirroring copies are network traffic from an elastic network
interface and the inner.
Is 81.
So from the easy to instance, if you'll go to the server to look into the elastic network interface
associated with it within your you see it is a DB one and the same we can see in the traffic mirroring
feature.
So any traffic that is coming to this specific network interface that is associated with the server
based easy to instance, the target is this specific one.
And if I'll quickly open this up, you basically see the destination which is the target.
So any traffic that is coming to server where exactly it needs to be copied to and then you have to
specify the network interface of the monitoring tool which ends with FCC and the same thing you see
in the destination over here.
Great.
So I hope that this at a high level overview, you understood the basics about the traffic monitoring
feature in VPC.