Traffic Mirroring Overview

What Is Traffic Mirroring?

Traffic Mirroring can be used to mirror traffic that meets a mirror filter from an elastic network interface. You can configure inbound and outbound rules for a mirror filter to determine which traffic from an elastic network interface will be mirrored to a network interface or load balancer. You can then send the traffic for inspection, audit analysis, and troubleshooting.

Currently, the Traffic Mirroring function is free. You will be notified in advance if the billing starts.

Currently, Traffic Mirroring is available only in certain regions. For details, visit Function Overview and click Traffic Mirroring.

Concepts

Working Principles

In Table 1, mirror sources network interface-B and network interface-C are used as examples to describe the traffic mirroring principle.

Figure 1 Traffic mirroring architecture

Application Scenarios

• Traffic inspection

  If there are network intrusions, you can use traffic mirroring to mirror required traffic to security software for comprehensively analysis and check. This helps to quickly locate security vulnerabilities and ensure network security.

• Traffic auditing

  You can use traffic mirroring to mirror traffic to a specific platform for auditing and analysis. This applies to scenarios that have high security requirements, such as finance.

• Fault locating

  O&M engineers can directly view mirrored traffic instead of capturing packets on service servers to locate faults. This prevents services from being affected during O&M.

Matching Rules

If a packet from the same mirror source meets multiple mirror filter rules, the packet is matched only once. The matching rules are described as follows:

• Figure 2 describes the matching process of mirror sessions. If a mirror source is associated with multiple mirror sessions, packets are matched in descending order of mirror session priorities. Inbound packets are used as an example here.
  • If a packet matches an inbound mirror filter rule of a mirror session:
    • The packet will be mirrored if the rule action is Accept.
    • The packet will not be mirrored if the rule action is Reject.
  • If a packet does not match any inbound mirror filter rule in a mirror session, the packet will not be mirrored.
  For example, a mirror source is associated with both mirror sessions A and B. The priority of mirror session A is 1 and that of mirror session B is 2. If a packet in the inbound direction of the mirror source meets the mirror filter rules of both mirror session A and mirror session B, the packet preferentially matches the mirror filter rules of mirror session A according to the priority, and will not match that of mirror session B.

  Figure 2 Mirror session matching process
  
• Figure 3 describes the matching process of mirror filter rules. If a mirror source is associated with only one mirror session, packets are matched in descending order of priorities of inbound mirror filter rules. Inbound packets are used as an example here.
  • If a packet matches an inbound mirror filter rule:
    • The packet will be mirrored if the rule action is Accept.
    • The packet will not be mirrored if the rule action is Reject.
  • If a packet does not match any inbound mirror filter rule, the packet will not be mirrored.
  For example, a mirror source is associated with mirror session A. The mirror filter of mirror session A has inbound rules A and B, which have the same traffic matching conditions but different priorities and actions. The priority of rule A is 1, and the action is Reject. The priority of rule B is 2, and the action is Accept. If a packet in the inbound direction of the mirror source meets the traffic matching conditions of both rule A and rule B, the packet matches rule A first according to the rule priority. The packet will be rejected and will not be mirrored and match rule B.

  Figure 3 Mirror filter rule matching process
  

Quotas

Notes and Constraints

• As shown in Figure 4, mirrored traffic is encapsulated in the standard VXLAN packet format. For more information about the VXLAN protocol, see RFC 7348. If the total length of mirrored packets and VXLAN packets is greater than the MTU of the mirror source, the system truncates the packets. To prevent packets from being truncated, you are advised to set the MTU of the elastic network interface to be at least 64 bytes smaller than the MTU supported by the link in IPv4 scenarios.
  Figure 4 Traffic Mirroring packet format
  
• Currently, only elastic network interfaces of c7t ECSs can be used as mirror sources.
• An elastic network interface cannot be used as both a mirror source and a mirror target at the same time.
• Traffic Mirroring occupies the bandwidth of instances attached to elastic network interfaces and does not have bandwidth limits.
• If a mirror target needs to receive mirrored traffic from multiple mirror sources, ensure that the mirror target has proper specifications based on service requirements.
• If a packet from a mirror source meets multiple mirror filter rules, the packet will be matched only once and will be accepted or rejected to a mirror target according to the rule action.
• If a packet from a mirror source is discarded by a security group or network ACL, the packet will not be mirrored.
• If a packet from a mirror source meets a mirror filter, the packet will be mirrored and will not be restricted by outbound rules of a security group or network ACL of the mirror source. That is, you do not need to configure the security group or network ACL for the mirror source. However, if you want to mirror the packet to the mirror target, you need to configure the following rules for the security group and network ACL of the mirror target:
  • Add a security group rule to allow inbound UDP packets from the IP address of the mirror source (elastic network interface) over port 4789. Table 5 shows a rule example if the IP address of the mirror source is 192.168.0.27. To learn about how to add a rule, see Adding a Security Group Rule.

    Table 5 Security group rule example

    Direction	Action	Type	Protocol & Port	Source
    Inbound	Allow	IPv4	UDP: 4789	IP address: 192.168.0.27/32 Set the IP address based on the actual requirements.

  • Add a network ACL rule to allow inbound UDP packets from the IP address of the mirror source (elastic network interface) over any port. Table 6 shows a rule example if the IP address of the mirror source is 192.168.0.27. To learn about how to add a rule, see Adding a Network ACL Rule.

    Table 6 Network ACL rule example

    Direction	Type	Action	Protocol	Source	Source Port Range	Destination	Destination Port Range
    Inbound	IPv4	Allow	UDP	IP address: 192.168.0.27/32 Set the IP address based on the actual requirements.	If not specified, all ports are used.	IP address: 10.10.0.0/24 Set the IP address based on the actual requirements.	4789 Port 4789 must be opened. Open other ports based on the actual requirements.

• Resources from different VPCs cannot communicate with each other. If a mirror source and a mirror target are not in the same VPC, you need to use a VPC peering connection or an enterprise router to connect their VPCs first.
  • To use a VPC peering connection, see VPC Peering Connection Overview.
  • To use an enterprise router, see Using an Enterprise Router to Enable Communications Between VPCs in the Same Region.

Usage Process

To use the traffic mirroring function, you need to create a mirror session and associate a mirror filter, mirror sources, and a mirror target with the mirror session. Figure 5 shows the process.

Figure 5 Process of using Traffic Mirroring