# Traffic Mirroring

## Overview

Pynt Traffic Capture is a powerful solution for real-time application traffic monitoring. This infrastructure automatically captures traffic from your Application Load Balancers (ALBs), providing an API catalog of your application's behavior and security.

## Key Features

* **Real-time Traffic Analysis**: Capture and analyze traffic in real-time without impacting your application performance
* **High Availability**: Deployed across multiple Availability Zones for maximum reliability
* **Secure by Design**:
  * Runs in your network
  * Minimal required permissions
  * Secure parameter handling
* **Easy Deployment**: One-click deployment using AWS CloudFormation
* **Automatic Recovery**: Auto Scaling Group ensures continuous operation
* **Flexible Configuration**: Customize instance types, security settings, and upload intervals

## Architecture

The Pynt Traffic Capture infrastructure consists of:

1. **Traffic Capture Components**:
   * Sniffer ([Suricata](https://github.com/OISF/suricata)): Captures and processes network traffic
   * [Traffic Mirroring](https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html): Manages traffic mirroring sessions with ALBs
   * Pynt's service aggregates and uploads the traffic metadata to Pynt's SaaS platform
2. **Infrastructure Components**:
   * Auto Scaling Group: Ensures high availability and automatic recovery
   * Security Groups: Controls access to the capture infrastructure
   * IAM Roles: Provides necessary permissions with least privilege

## Prerequisites

Before deploying, ensure you have:

1. An AWS account with appropriate permissions
2. A VPC with at least two private subnets in different Availability Zones
3. An EC2 key pair for SSH access
4. The following information:
   * VPC ID
   * List of subnet IDs (at least 2 recommended for high availability)
   * Pynt API key, **please ask Pynt's team!**
   * Application ID
   * CIDR block for allowed UDP traffic
5. CloudFormation template (`pynt-traffic-capture.yaml`). **Please ask Pynt's team!**

## Deployment Options

### Option 1: AWS Console (Recommended for First-Time Users)

1. Go to the AWS CloudFormation console.
2. Click "Create stack"
3. Choose "Template is ready"
4. Upload the template file
5. Fill in the required parameters
6. Click through to create the stack

### Option 2: AWS CLI 

1. Create a parameters file (`parameters.json`):

```json
[
  {
    "ParameterKey": "VpcId",
    "ParameterValue": "vpc-xxxxxxxx"
  },
  {
    "ParameterKey": "SubnetIds",
    "ParameterValue": "subnet-xxxxxxxx,subnet-yyyyyyyy"
  },
  {
    "ParameterKey": "KeyName",
    "ParameterValue": "your-key-pair"
  },
  { 
    "ParameterKey": "AllowedIPs",
    "ParameterValue": "0.0.0.0/0"
  },
  {
    "ParameterKey": "AllowedCidr",
    "ParameterValue": "0.0.0.0/0"
  },
  {
    "ParameterKey": "ApiKey",
    "ParameterValue": "your-api-key"
  },
  {
    "ParameterKey": "ApplicationId",
    "ParameterValue": "your-application-id"
  }
]
```

2. Deploy using AWS CLI:

```bash
aws cloudformation create-stack \
  --stack-name pynt-traffic-capture \
  --template-body file://pynt-traffic-capture.yaml \
  --parameters file://parameters.json \
  --capabilities CAPABILITY_IAM
```

## Configuration Options

| Parameter                 | Description                                                                                  | Default    |
| ------------------------- | -------------------------------------------------------------------------------------------- | ---------- |
| VpcId                     | The VPC ID where resources will be created and where your application to monitor will exist. | -          |
| SubnetIds                 | List of subnet IDs (at least 2 recommended)                                                  | -          |
| KeyName                   | EC2 KeyPair for SSH access                                                                   | -          |
| AllowedIPs                | IP range allowed for SSH access                                                              | 0.0.0.0/0  |
| AllowedCidr               | A CIDR block for UDP traffic. The CIDR block should be from the VPC you specified.           | 0.0.0.0/0  |
| InstanceType              | EC2 instance type                                                                            | t3a.medium |
| ApiKey                    | Your Pynt API key                                                                            | -          |
| ApplicationId             | Your Pynt Application ID                                                                     | -          |
| InitialUploadDelaySeconds | Initial delay before data upload                                                             | 60         |
| UploadIntervalSeconds     | Interval between data uploads                                                                | 60         |

## Security Considerations

* **Network Security**:
  * Instances run in your network
  * SSH access is restricted to a specific IP range
  * UDP traffic is restricted to a specific CIDR block
* **IAM Security**:
  * Minimal required permissions
  * Role-based access control
  * Secure handling of sensitive parameters
* **Instance Security**:
  * Automatic security updates
  * Secure bootstrapping process
  * Encrypted EBS volumes

## Maintenance

### Updating the Stack

To update the stack with new parameters or configuration:

```bash
aws cloudformation update-stack \
  --stack-name pynt-traffic-capture \
  --template-body file://pynt-traffic-capture.yaml \
  --parameters file://parameters.json \
  --capabilities CAPABILITY_IAM
```

### Deleting the Stack

To remove the Pynt Traffic Capture infrastructure:

```bash
aws cloudformation delete-stack --stack-name pynt-traffic-capture
```

## Support

For assistance with deployment or troubleshooting, please get in touch with Pynt Support at [support@pynt.io](mailto:support@pynt.io?subject=SSO+Setup).