Senior LevelCloud Computing (AWS/GCP/Azure)
How does AWS VPC Traffic Mirroring capture and inspect raw packet data at scale?
❓ Interview Prompt: Explain AWS VPC Traffic Mirroring, out-of-band packet inspection, Network Interface (ENI) sources, and Intrusion Detection Systems (IDS).
Traditional agent-based packet capture inspects network traffic inside guest operating systems, consuming CPU resources and opening agent vulnerability vectors. AWS VPC Traffic Mirroring operates out-of-band.
How Traffic Mirroring Works:
1
Zero Agent Overhead: Operates directly at the VPC Elastic Network Interface (ENI) hypervisor layer.
2
VXLAN Encapsulation: Copies raw inbound/outbound L2-L7 network packets, encapsulating them inside VXLAN packets (UDP port 4789).
3
Out-of-Band Delivery: Streams mirrored packet streams to a Network Load Balancer (NLB) backing a cluster of open-source Intrusion Detection Systems (Suricata / Zeek / Snort) for deep packet inspection.
Code Implementation Example
hcl
# VPC Traffic Mirror Session mirroring EC2 ENI to IDS NLB target
resource "aws_ec2_traffic_mirror_session" "session" {
network_interface_id = aws_instance.web.primary_network_interface_id
traffic_mirror_target_id = aws_ec2_traffic_mirror_target.ids_target.id
traffic_mirror_filter_id = aws_ec2_traffic_mirror_filter.all_traffic.id
session_number = 1
}💡Terraform VPC Traffic Mirror Session copying ENI traffic to IDS target.
🎯 Interview Key Takeaway
VPC Traffic Mirroring copies raw ENI network packets out-of-band to VXLAN targets for deep packet security inspection without agent overhead.
#VPC Traffic Mirroring#Packet Inspection#IDS#Security#Senior
Back to all Cloud Computing (AWS/GCP/Azure) Questions→