How to Easily Filter the Traffic Mirroring in AWS VPC

Make the AWS VPC mirror traffic without a VXLAN header and filter packets like normal traffic in Wireshark.

Intro

In an AWS VPC, if we need to do traffic mirroring to check the packets on the ENI of EC2, we would like to use VPC traffic mirroring to mirror the traffic from the source ENI and send it to the ENI of the monitor host. This can help us to understand if the packets have been sent out from ENI or received on ENI.

How it work?

When we are setting the VPC traffic mirroring, we will need to define following things.

• Source — The network interface to monitor.
• Filter — A set of rules that defines the traffic that is mirrored.
• Target — The destination for mirrored traffic.
• Session — Establishes a relationship between a source, a filter, and a target.

A traffic mirror target is the destination for mirrored traffic. The mirror target can be

• ENI of EC2
• Network Load Balancer
• Gateway Load Balancer endpoint

If you use Wireshark or Tcpdump to capture packets, you will see the mirrored packets is encapsulated with VXLAN tunnel.

The packet format about mirrored traffic. Ref from https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-packet-formats.html

The mirrored traffic captured in target host.

If you use the filter condition you usually used, it might not filter the packet correctly due to all mirrored packets are encapsulated with VXLAN header.

A tip here, if you would like to capture the packet without VXLAN, you can use the ip command to create a VXLAN type interface.

sudo ip link add <NEW_INTERFACE_NAME> type vxlan \
id <VID> \
dstport 4789 \
remote <MIRROR_SOURCE_PRIVATE_IP> \
local <LOCAL_PRIVATE_IP> \
dev <LOCAL_NET_INTERFACE_NAME>

For example, following is my interface in my target host

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000
link/ether 12:90:f3:24:20:24 brd ff:ff:ff:ff:ff:ff
inet 172.31.1.62/20 brd 172.31.15.255 scope global dynamic eth0
valid_lft 2645sec preferred_lft 2645sec

I can use following command to create VXLAN type interface

$ sudo ip link add eth0.mrr.22 type vxlan \
id 22 \
dstport 4789 \
remote 172.31.3.73 \
local 172.31.1.62 \
dev eth0

When I capture the packets in eth0.mrr.22, it will look like the following and you can use the same filter condition as you usually do.

Limitation

The first limitation we need to notice is Traffic Mirroring only available in part of instance types.

Instance Types

Traffic Mirroring is not available on the following virtualized Nitro instance types:

• General purpose: M6a, M6i, M6id, M6idn, M6in, M7a, M7g, M7gd, M7i, M7i-flex
• Compute optimized: C6a, C6gd, C6gn, C6i, C6id, C6in, C7a, C7g, C7gd, C7gn, C7i
• Memory optimized: R6a, R6i, R6id, R6idn, R6in, R7a, R7g, R7gd, R7i, R7iz, X2idn, X2iedn, X2iezn
• Storage optimized: I4g, I4i, Im4gn, Is4gen
• Accelerated computing: Inf2, P5, Trn1, Trn1n
• High-performance computing: Hpc6a, Hpc6id, Hpc7a, Hpc7g

Traffic Mirroring is not available on bare metal instances.

Traffic Mirroring is available only on the following non-Nitro instances types: C4, D2, G3, G3s, H1, I3, M4, P2, P3, R4, X1, and X1e. Note that this does not include T2 instances.

IPv6 traffic

• Traffic Mirroring is not supported for IPv6-only subnets.

Traffic types

Following types are not support mirroring

• ARP
• DHCP
• Instance metadata service
• NTP
• Windows activation

For more detail, please refer

[embed]Traffic Mirroring limitations Learn about the limitations for Traffic Mirroring and how to increase them.docs.aws.amazon.com