Traffic Mirroring

What Is Traffic Mirroring?

Traffic Mirroring can be used to mirror traffic that meets a mirror filter from mirror sources, such as elastic network interfaces. You can configure inbound and outbound rules for a mirror filter to determine which traffic will be mirrored from mirror sources to a mirror target, such as a network interface or load balancer. You can then send the traffic for inspection, audit analysis, and troubleshooting.

Currently, the Traffic Mirroring function is free. You will be notified in advance if the billing starts.

Currently, Traffic Mirroring is available only in certain regions. For details, visit Function Overview and click Traffic Mirroring.

Concepts

Working Principles

In Table 1, mirror sources network interface-B and network interface-C are used as examples to describe the traffic mirroring principle.

Figure 1 Traffic mirroring architecture

Application Scenarios

• Traffic inspection

  If there are network intrusions, you can use traffic mirroring to mirror required traffic to security software for comprehensively analysis and check. This helps to quickly locate security vulnerabilities and ensure network security.

• Traffic auditing

  You can use traffic mirroring to mirror traffic to a specific platform for auditing and analysis. This applies to scenarios that have high security requirements, such as finance.

• Fault locating

  O&M engineers can directly view mirrored traffic instead of capturing packets on service servers to locate faults. This prevents services from being affected during O&M.

Matching Rules

If a packet from the same mirror source meets multiple mirror filter rules, the packet is matched only once. The matching rules are described as follows:

• Figure 2 describes the matching process of mirror sessions. If a mirror source is associated with multiple mirror sessions, packets are matched in descending order of mirror session priorities. Inbound packets are used as an example here.
  • If a packet matches an inbound mirror filter rule of a mirror session:
    • The packet will be mirrored if the rule action is Accept.
    • The packet will not be mirrored if the rule action is Reject.
  • If a packet does not match any inbound mirror filter rule in a mirror session, the packet will not be mirrored.
  For example, a mirror source is associated with both mirror sessions A and B. The priority of mirror session A is 1 and that of mirror session B is 2. If a packet in the inbound direction of the mirror source meets the mirror filter rules of both mirror session A and mirror session B, the packet preferentially matches the mirror filter rules of mirror session A according to the priority, and will not match that of mirror session B.

  Figure 2 Mirror session matching process
  
• Figure 3 describes the matching process of mirror filter rules. If a mirror source is associated with only one mirror session, packets are matched in descending order of priorities of inbound mirror filter rules. Inbound packets are used as an example here.
  • If a packet matches an inbound mirror filter rule:
    • The packet will be mirrored if the rule action is Accept.
    • The packet will not be mirrored if the rule action is Reject.
  • If a packet does not match any inbound mirror filter rule, the packet will not be mirrored.
  For example, a mirror source is associated with mirror session A. The mirror filter of mirror session A has inbound rules A and B, which have the same traffic matching conditions but different priorities and actions. The priority of rule A is 1, and the action is Reject. The priority of rule B is 2, and the action is Accept. If a packet in the inbound direction of the mirror source meets the traffic matching conditions of both rule A and rule B, the packet matches rule A first according to the rule priority. The packet will be rejected and will not be mirrored and match rule B.

  Figure 3 Mirror filter rule matching process
  

Traffic Mirroring Quotas

Notes and Constraints

• As shown in Figure 4, mirrored traffic is encapsulated in the standard VXLAN packet format. For more information about the VXLAN protocol, see RFC 7348. If the total length of mirrored packets and VXLAN packets is greater than the MTU of the mirror source, the system truncates the packets. To prevent packets from being truncated, you are advised to set the MTU of the elastic network interface to be at least 64 bytes smaller than the MTU supported by the link in IPv4 scenarios.
  Figure 4 Traffic Mirroring packet format
  
• Table 5 and Table 6 show the constraints on different types of mirror sources and mirror targets.

  Table 5 Constraints on mirror sources

  Mirror Source Type

  Constraints

  Elastic network interface

  If the mirror source is an elastic network interface, the network interface needs to be attached to an ECS. Only the network interface of an ECS with certain flavors (such as C7t and aC7) can be used as mirror sources. You can call APIs to query details about ECS flavors and use the response value of network_interface:traffic_mirroring_supported to check whether an ECS flavor supports traffic mirroring. An elastic network interface cannot be used as both a mirror source and a mirror target at the same time. Traffic Mirroring occupies the bandwidth of instances attached to elastic network interfaces and does not have bandwidth limits.

  Table 6 Constraints on mirror targets

  Mirror Target Type	Constraints
  Network interface	If a mirror target needs to receive mirrored traffic from multiple mirror sources, ensure that the mirror target has proper specifications based on service requirements. An elastic network interface cannot be used as both a mirror source and a mirror target at the same time.
  Load balancer	The encapsulated mirrored packet uses the IPv4 UDP protocol. So the dedicated load balancer used as the mirror target must support IPv4 UDP.

• If a packet from a mirror source meets multiple mirror filter rules, the packet will be matched only once and will be accepted or rejected to a mirror target according to the rule action.
• If a packet from a mirror source is discarded by a security group or network ACL, the packet will not be mirrored.
• If a packet from a mirror source meets a mirror filter, the packet will be mirrored and will not be restricted by outbound rules of a security group or network ACL of the mirror source. This means you do not need to configure the security group or network ACL for the mirror source. However, if you want to mirror the packet to the mirror target, you need to configure the following rules for the security group and network ACL of the mirror target:
  • Add a security group rule to allow inbound UDP packets from the mirror source over port 4789.
    Table 7 shows a rule example if the private IP address of the mirror source is 192.168.0.27. To learn about how to add a rule, see Adding a Security Group Rule.

    Table 7 Security group rule configuration example (a network interface as the mirror source)

    Direction	Action	Type	Protocol & Port	Source
    Inbound	Allow	IPv4	UDP: 4789	192.168.0.27/32 Set the source based on the actual requirements.

  • Add a network ACL rule to allow inbound UDP packets from the mirror source over port 4789.
    Table 8 shows a rule example if the IP address of the mirror source is 192.168.0.27. To learn about how to add a rule, see Adding a Network ACL Rule.

    Table 8 Network ACL rule configuration example (a network interface as the mirror source)

    Direction	Type	Action	Protocol	Source	Source Port Range	Destination	Destination Port Range
    Inbound	IPv4	Allow	UDP	192.168.0.27/32 Set the source based on the actual requirements.	If not specified, all ports are used.	If the mirror target is a network interface, configure its private IPv4 address as the destination, for example, 192.168.1.24/32. If mirror target is a load balancer, configure its private IPv4 address as the destination, for example, 192.168.1.25/32. Set the destination based on the actual requirements. Ensure that the IP address of the mirror target is within the destination CIDR block.	4789 Port 4789 must be opened. Open other ports based on the actual requirements.

• Resources from different VPCs cannot communicate with each other. If a mirror source and a mirror target are not in the same VPC, you need to use a VPC peering connection or an enterprise router to connect their VPCs first.
  • To use a VPC peering connection, see VPC Peering Connection Overview.
  • To use an enterprise router, see Using an Enterprise Router to Enable Communications Between VPCs in the Same Region.

Usage Process

To use the traffic mirroring function, you need to create a mirror session and associate a mirror filter, mirror sources, and a mirror target with the mirror session. Figure 5 shows the process.

Figure 5 Process of using Traffic Mirroring