🔘Traffic Mirroring

Overview

Pynt Traffic Capture is a powerful solution for real-time application traffic monitoring. This infrastructure automatically captures traffic from your Application Load Balancers (ALBs), providing an API catalog of your application's behavior and security.

Key Features

• Real-time Traffic Analysis: Capture and analyze traffic in real-time without impacting your application performance

• High Availability: Deployed across multiple Availability Zones for maximum reliability

• Secure by Design:

  • Runs in your network

  • Minimal required permissions

  • Secure parameter handling

• Easy Deployment: One-click deployment using AWS CloudFormation

• Automatic Recovery: Auto Scaling Group ensures continuous operation

• Flexible Configuration: Customize instance types, security settings, and upload intervals

Architecture

The Pynt Traffic Capture infrastructure consists of:

1. Traffic Capture Components:

   • Sniffer (Suricata): Captures and processes network traffic

   • Traffic Mirroring: Manages traffic mirroring sessions with ALBs

   • Pynt's service aggregates and uploads the traffic metadata to Pynt's SaaS platform

2. Infrastructure Components:

   • Auto Scaling Group: Ensures high availability and automatic recovery

   • Security Groups: Controls access to the capture infrastructure

   • IAM Roles: Provides necessary permissions with least privilege

Prerequisites

Before deploying, ensure you have:

1. An AWS account with appropriate permissions

2. A VPC with at least two private subnets in different Availability Zones

3. An EC2 key pair for SSH access

4. The following information:

   • VPC ID

   • List of subnet IDs (at least 2 recommended for high availability)

   • Pynt API key, please ask Pynt's team!

   • Application ID

   • CIDR block for allowed UDP traffic

5. CloudFormation template (pynt-traffic-capture.yaml). Please ask Pynt's team!

Deployment Options

Option 1: AWS Console (Recommended for First-Time Users)

1. Go to the AWS CloudFormation console.

2. Click "Create stack"

3. Choose "Template is ready"

4. Upload the template file

5. Fill in the required parameters

6. Click through to create the stack

Option 2: AWS CLI

1. Create a parameters file (parameters.json):

[
  {
    "ParameterKey": "VpcId",
    "ParameterValue": "vpc-xxxxxxxx"
  },
  {
    "ParameterKey": "SubnetIds",
    "ParameterValue": "subnet-xxxxxxxx,subnet-yyyyyyyy"
  },
  {
    "ParameterKey": "KeyName",
    "ParameterValue": "your-key-pair"
  },
  { 
    "ParameterKey": "AllowedIPs",
    "ParameterValue": "0.0.0.0/0"
  },
  {
    "ParameterKey": "AllowedCidr",
    "ParameterValue": "0.0.0.0/0"
  },
  {
    "ParameterKey": "ApiKey",
    "ParameterValue": "your-api-key"
  },
  {
    "ParameterKey": "ApplicationId",
    "ParameterValue": "your-application-id"
  }
]

1. Deploy using AWS CLI:

aws cloudformation create-stack \
  --stack-name pynt-traffic-capture \
  --template-body file://pynt-traffic-capture.yaml \
  --parameters file://parameters.json \
  --capabilities CAPABILITY_IAM

Configuration Options

Parameter	Description	Default
VpcId	The VPC ID where resources will be created and where your application to monitor will exist.	-
SubnetIds	List of subnet IDs (at least 2 recommended)	-
KeyName	EC2 KeyPair for SSH access	-
AllowedIPs	IP range allowed for SSH access	0.0.0.0/0
AllowedCidr	A CIDR block for UDP traffic. The CIDR block should be from the VPC you specified.	0.0.0.0/0
InstanceType	EC2 instance type	t3a.medium
ApiKey	Your Pynt API key	-
ApplicationId	Your Pynt Application ID	-
InitialUploadDelaySeconds	Initial delay before data upload	60
UploadIntervalSeconds	Interval between data uploads	60

Security Considerations

• Network Security:

  • Instances run in your network

  • SSH access is restricted to a specific IP range

  • UDP traffic is restricted to a specific CIDR block

• IAM Security:

  • Minimal required permissions

  • Role-based access control

  • Secure handling of sensitive parameters

• Instance Security:

  • Automatic security updates

  • Secure bootstrapping process

  • Encrypted EBS volumes

Maintenance

Updating the Stack

To update the stack with new parameters or configuration:

aws cloudformation update-stack \
  --stack-name pynt-traffic-capture \
  --template-body file://pynt-traffic-capture.yaml \
  --parameters file://parameters.json \
  --capabilities CAPABILITY_IAM

Deleting the Stack

To remove the Pynt Traffic Capture infrastructure:

aws cloudformation delete-stack --stack-name pynt-traffic-capture

Support

For assistance with deployment or troubleshooting, please get in touch with Pynt Support at [email protected].