AWS re:Invent 2015 | (NET403) Another Day, Another Billion Packets
Why Hacker News recommends it
Considered a favorite deep dive into how AWS does virtual networking at L3 and why VPC hosts cannot snoop each other.
What it is
Eric Brandwine's AWS re:Invent 2015 session on how Amazon VPC networking works. It covers the problems the design solved, why traditional approaches do not scale, and the mechanisms used for customer isolation and VPC endpoints.
Recommended by 3 HN commenters across 3 different months, 2017 to 2020.
What Hacker News said
Strong rec ignoramous · 2019-03 · on “Nginx to Be Acquired by F5 Networks”
Here's the ever excellent Eric Brandwine explaining what AWS does at L3 wrt VPC: [this video] Here's the super versatile Colm Mac explaining what AWS does at L4: [LINK] --- Google has been very open about their network infrastructure, here's a nice summary from 2015: [LINK] and not mentioned in that blog... their NetworkLoadBalancer, Maglev: [LINK] (AWS equivalent of which would be HyperPlane: [LINK] allegedly based on S3's load balancer).
Recommends colmmacc · 2017-11 · on “VPC Endpoints for Your Own Applications and Services”
There's lots on [LINK] , and talks on youtube ( [this video] is a fav). But the TLDR is this: VPC stands for "Virtual Private Cloud" and it gives you your own virtual data center on AWS. You get a private network that uses whatever IP range you'd like, and you can connect to it privately via VPN or Direct Connect (physical links). You can also connect it to the internet with Elastic IP Addresses. VPCs are free and you can create and edit them programmatically (add subnets, change routes, manage ACLs and security groups) - so they're a useful way to manage an environment of things like EC2 instances, containers, Elastic Load Balancers, RDS databases, Lambda functions, and more, without needing to
Recommends thinkharderdev · 2020-05 · on “Redis 6.0 GA”
You can't snoop on traffic between hosts in the same VPC. Here is a good video explaining why [this video] . The tl;dr; is that your guest OS (the EC2 instance) is not connected to the physical layer 2 network. The host OS hypervisor is and when it receives a packet from the physical NIC, if that packet is not directed to the guest OS then it won't be passed to it. So the NIC on the guest OS (your EC2 instance) will never even see the packets that are not intended for it. Of course this gets slightly more complicated because AWS added some tools for traffic mirroring. So theoretically someone with the right access could setup a mirror to a host they control in the VPC and sniff the traffic that w