Documentation
  • 🍻Intro
    • Why API Security is Critical?
    • Pynt at a Glance
    • Who Should Use Pynt?
  • 👩‍💻API Security Testing
    • Security Testing Overview
    • Prerequisites for Running Pynt Scans
    • How to Install Pynt CLI
    • How to install Pynt Binary (Linux only)
    • Pynt CLI Modes
      • 🔵Pynt Command CLI Mode
      • 🔵Pynt Listen CLI Mode
    • Pynt Security Tests Coverage
      • Business Logic Tests
      • Injection Tests
      • Authentication Bypass Tests
      • Mass Assignment Tests
      • Server-Side Request Forgery Tests
      • Stack Trace In Response
      • Lack of Resources and Rate Limiting
      • File Path Manipulation
      • GraphQL Introspection Vulnerability
      • GraphQL Alias Overloading
      • LLM APIs Vulnerabilities
      • Insecure Transport Scheme
      • Basic Authentication
      • HTTP Desynchronization (Desync) Attack
    • Sensitive Data Exposure Detection
    • Pynt Scans Troubleshooting
      • Pynt CLI Troubleshooting
      • Pynt for Postman Troubleshooting
        • Troubleshoot Pynt Container not Running Error
        • Troubleshoot Empty API Key Error
        • Troubleshoot Unauthorized API Key Error
        • Troubleshoot Collection Not Found Error
        • Troubleshoot Non-Unique Collection Name Error
        • Troubleshoot Empty Collection Identifier Error
        • Troubleshoot Unreachable Target Error
        • Troubleshoot Target Responds with Errors Error
        • Troubleshoot Unresolved Target Domain Error
        • Troubleshoot Unresolved Variable Error
        • Troubleshoot TLS Handshake Fail Error
        • Troubleshoot Few Requests Error
        • Troubleshoot One User Only Error
        • Troubleshoot Failed Assertions Error
    • How To
      • How to Run Business Logic Tests with Pynt
      • How to associate a Pynt scan to an Application in Pynt Dashboard
      • How to tag a scan in Pynt
    • Benchmarks
      • Pynt vs OWASP crAPI
  • 🤲Security Testing Integrations
    • 🟠Pynt with API Testing Tools
      • 🔘Pynt for Postman
        • Fork Pynt Collection
        • Run Pynt Container
        • Run Pynt in Postman
        • View Scan Results in Postman
      • 🔘Pynt for Insomnia
      • 🔘Pynt for ReadyAPI
    • 🟠Pynt with API Testing CLIs
      • 🔘Pynt for Newman (Postman CLI)
      • 🔘Pynt for TestRunner (ReadyAPI CLI)
    • 🟠Pynt with Testing Frameworks
      • 🔘Pynt for Selenium
      • 🔘Pynt for Rest Assured
      • 🔘Pynt for Jest
      • 🔘Pynt for pytest
      • 🔘Pynt for Go
      • 🔘Pynt for JMeter
    • 🟠Pynt on CI/CD
      • ❗How to get Pynt ID for CI/CD Authentication
      • 🔘Pynt for GitHub Actions
      • 🔘Pynt for Azure DevOps Pipelines
      • 🔘Pynt for GitLab
      • 🔘Pynt for Jenkins
    • 🟠Pynt with Burp Suite
    • 🟠Pynt with Browsers
      • 🔘Pynt for Firefox Browser
    • 🟠Live Traffic Connectors
      • 🔘eBPF
        • 🔘Key Components
      • 🔘Traffic Mirroring
    • 🟠Advanced Pynt Examples
      • 🔘Pynt as a Standalone Container
      • 🔘Pynt with Prerecorded Har Files
      • 🔘Pynt with cURL
  • 🈸Applications View
    • Application View Overview
    • Manage Applications
      • Add Application
      • Delete Application
      • Rename Application
    • Manage Sources for API Discovery
      • Add Source
      • Delete Source
      • View Source Info
      • Source Categories
        • API Documentation
          • Swagger
          • Postman Collection
        • API Gateways
          • AWS API Gateway
          • Azure API Gateway
          • Kong API Gateway
          • GCP API Gateway
          • Gravitee API Gateway
        • Testing (API Security Scans)
        • Live Traffic
          • Data Collection with eBPF
          • ALB Traffic Capture with AWS Traffic Mirroring
        • Code Repository
    • Application Dashboard
    • Generate Pentest Report
  • 📚API Catalog
    • API Catalog Overview
    • Navigate API Catalog
      • Filtering API Catalog by Application
      • API Catalog Customization
      • API Related Info
      • APIs at Risk
    • Manage API Source Gaps
      • New APIs
      • Untested APIs
      • Shadow APIs
      • Undocumented APIs
    • View Detailed Endpoint Info
  • ⏪Scan History
    • Scan History Overview
    • Navigate Scan History
      • Associating Scans with Specific Application
      • Filtering by Application
      • Scan Related Info
      • Scan History Customization
    • View Detailed Scan Info
    • Associate Vulnerabilities to Tickets with JIRA
  • Account Management
    • Single Sign-On (SSO)
      • Setting up Okta
      • Setting up Entra ID
Powered by GitBook
On this page
  • Overview
  • Key Features
  • Architecture
  • Prerequisites
  • Deployment Options
  • Option 1: AWS Console (Recommended for First-Time Users)
  • Option 2: AWS CLI
  • Configuration Options
  • Security Considerations
  • Maintenance
  • Updating the Stack
  • Deleting the Stack
  • Support
  1. Security Testing Integrations
  2. Live Traffic Connectors

Traffic Mirroring

Overview

Pynt Traffic Capture is a powerful solution for real-time application traffic monitoring. This infrastructure automatically captures traffic from your Application Load Balancers (ALBs), providing an API catalog of your application's behavior and security.

Key Features

  • Real-time Traffic Analysis: Capture and analyze traffic in real-time without impacting your application performance

  • High Availability: Deployed across multiple Availability Zones for maximum reliability

  • Secure by Design:

    • Runs in your network

    • Minimal required permissions

    • Secure parameter handling

  • Easy Deployment: One-click deployment using AWS CloudFormation

  • Automatic Recovery: Auto Scaling Group ensures continuous operation

  • Flexible Configuration: Customize instance types, security settings, and upload intervals

Architecture

The Pynt Traffic Capture infrastructure consists of:

  1. Traffic Capture Components:

    • Pynt's service aggregates and uploads the traffic metadata to Pynt's SaaS platform

  2. Infrastructure Components:

    • Auto Scaling Group: Ensures high availability and automatic recovery

    • Security Groups: Controls access to the capture infrastructure

    • IAM Roles: Provides necessary permissions with least privilege

Prerequisites

Before deploying, ensure you have:

  1. An AWS account with appropriate permissions

  2. A VPC with at least two private subnets in different Availability Zones

  3. An EC2 key pair for SSH access

  4. The following information:

    • VPC ID

    • List of subnet IDs (at least 2 recommended for high availability)

    • Pynt API key, please ask Pynt's team!

    • Application ID

    • CIDR block for allowed UDP traffic

  5. CloudFormation template (pynt-traffic-capture.yaml). Please ask Pynt's team!

Deployment Options

Option 1: AWS Console (Recommended for First-Time Users)

  1. Go to the AWS CloudFormation console.

  2. Click "Create stack"

  3. Choose "Template is ready"

  4. Upload the template file

  5. Fill in the required parameters

  6. Click through to create the stack

Option 2: AWS CLI

  1. Create a parameters file (parameters.json):

[
  {
    "ParameterKey": "VpcId",
    "ParameterValue": "vpc-xxxxxxxx"
  },
  {
    "ParameterKey": "SubnetIds",
    "ParameterValue": "subnet-xxxxxxxx,subnet-yyyyyyyy"
  },
  {
    "ParameterKey": "KeyName",
    "ParameterValue": "your-key-pair"
  },
  { 
    "ParameterKey": "AllowedIPs",
    "ParameterValue": "0.0.0.0/0"
  },
  {
    "ParameterKey": "AllowedCidr",
    "ParameterValue": "0.0.0.0/0"
  },
  {
    "ParameterKey": "ApiKey",
    "ParameterValue": "your-api-key"
  },
  {
    "ParameterKey": "ApplicationId",
    "ParameterValue": "your-application-id"
  }
]
  1. Deploy using AWS CLI:

aws cloudformation create-stack \
  --stack-name pynt-traffic-capture \
  --template-body file://pynt-traffic-capture.yaml \
  --parameters file://parameters.json \
  --capabilities CAPABILITY_IAM

Configuration Options

Parameter
Description
Default

VpcId

The VPC ID where resources will be created and where your application to monitor will exist.

-

SubnetIds

List of subnet IDs (at least 2 recommended)

-

KeyName

EC2 KeyPair for SSH access

-

AllowedIPs

IP range allowed for SSH access

0.0.0.0/0

AllowedCidr

A CIDR block for UDP traffic. The CIDR block should be from the VPC you specified.

0.0.0.0/0

InstanceType

EC2 instance type

t3a.medium

ApiKey

Your Pynt API key

-

ApplicationId

Your Pynt Application ID

-

InitialUploadDelaySeconds

Initial delay before data upload

60

UploadIntervalSeconds

Interval between data uploads

60

Security Considerations

  • Network Security:

    • Instances run in your network

    • SSH access is restricted to a specific IP range

    • UDP traffic is restricted to a specific CIDR block

  • IAM Security:

    • Minimal required permissions

    • Role-based access control

    • Secure handling of sensitive parameters

  • Instance Security:

    • Automatic security updates

    • Secure bootstrapping process

    • Encrypted EBS volumes

Maintenance

Updating the Stack

To update the stack with new parameters or configuration:

aws cloudformation update-stack \
  --stack-name pynt-traffic-capture \
  --template-body file://pynt-traffic-capture.yaml \
  --parameters file://parameters.json \
  --capabilities CAPABILITY_IAM

Deleting the Stack

To remove the Pynt Traffic Capture infrastructure:

aws cloudformation delete-stack --stack-name pynt-traffic-capture

Support

PreviousKey ComponentsNextAdvanced Pynt Examples

Last updated 21 days ago

Sniffer (): Captures and processes network traffic

: Manages traffic mirroring sessions with ALBs

For assistance with deployment or troubleshooting, please get in touch with Pynt Support at .

🤲
🟠
🔘
Suricata
Traffic Mirroring
support@pynt.io