A Day in the Life of a Billion Packets (CPN401) | AWS re:Invent 2013

What people said

Strong rec EEAA · 2014-02 · Server Fault · on “Traffic in a AWS virtual private cloud”

Traffic within your VPC can be considered quite private. Yes, a relatively small number of AWS engineers could theoretically view the traffic. If an engineer did that without need, though (support ticket, etc.), they would lose their job. The traffic is most definitely not viewable by any other EC2 customers. Like @ceejayoz said above, if you are worried about data privacy, then sure, set up IPSec in transport mode between your instances. If you're interested in the nuts and bolts of how VPC works, including the security mechanisms they have in place, see A Day in the Life of a Billion Packets [this video] , which was my favorite of all the sessions I attended at the AWS re:Invent conference last

Strong rec Michael - sqlbot · 2016-05 · Stack Overflow · on “Are there differences in networking performance if EC2 instances are in different subnets?”

There is no difference in performance or reliability when instances are on the same subnet, or on different subnets within the same availability zone, because of the way the network infrastructure actually works in VPC. This is because the network is not really an Ethernet network with routers. The entire network infrastructure in VPC is virtual, software-defined. The best way to see this for yourself is to sniff packets on two machines on the same subnet. You'll find a significant difference in the behavior of ARP. On a "normal" network, machines on the same subnet are also in the same broadcast domain. They discover each other's hardware address by "arping" for each other, with "who has/te

Strong rec Michael - sqlbot · 2017-10 · Stack Overflow · on “integration of ntopng on aws centos”

I'm with you, but putting an interface into promiscuous mode is not mentioned (and not harmful). Perhaps I misread your statement and you are saying that snooping in general (rather than promiscuous mode, specifically) is forbidden, in which case you'd be right, because snooping would require deliberate attempts to breach the established infrastructure's intrinsic ability to prevent this. A Day in the Life of a Billion Packets [this video] and its follow-ups are excellent views into the inner-workings of the network implementation, for anyone who hasn't seen them.

Recommends Michael - sqlbot · 2014-02 · Stack Overflow · on “Is the role of router in AWS-VPC played by a virtual machine?”

No, it isn't played by a virtual machine, or even a set of virtual machines. Thinking about it for a moment, a VPC router couldn't possibly be a single "thing" because that wouldn't be redundant... it would have to be at least six "things" (3 availability zones x 2 devices minimum per availability zone for redundancy, plus all of the requisite interconnections)... and those things would have to be infinitely and transparently scalable... and then don't forget that your instances are typically not the only machine on their physical host, and can be scattered throughout the physical facility that comprises each availability zone. So, no. "A Day in the Life of a Billion Packets (CPN401)" -- the

Recommends Michael - sqlbot · 2015-03 · Server Fault · on “Amazon EC2: OpenVPN server won't route bridged packets from client to VPC subnet”

Your VPN needs to be routed, not bridged, and the subnet that your VPN clients are on has to be outside the bounds of the VPC supernet. Then, you add a static route for the VPN client subnet in the VPC routing tables, with the destination of that route specified as the instance ID of your vpn server instance. The VPC network is a virtual, software-defined network. It's not a pure layer 2 network, but in most ways, it emulates one quite nicely. Broadcasts, though, aren't one of those ways. If you notice, there is not a 1:1 correlation of ARP traffic from one instance to another. The response you get to an ARP who-has doesn't come from the instance with the IP assigned. It comes from the netwo

Recommends dan4thewin · 2016-02 · Stack Overflow · on “TCP Package Forging within AWS VPC”

It's definitely encapsulated. This video from the AWS re:Invent conference describes the system well: A Day in the Life of a Billion Packets (CPN401) | AWS re:Invent 2013 [this video] . Discussion of the mapping service starts around 18 minutes in.

Recommends jamie · 2016-09 · Stack Overflow · on “AWS IPV6 Support”

This presentation [this video] from re:Invent 2013 describes VPCs and how packets are routed in and between subnets. Particular details at 24 minute mark. Bottom line: you don't need to worry about a third party sniffing your packets. From the description, packets are verified at both the sender and the receiver, so even if the fabric fails and sends your packet to someone else's instance, the low-level driver on that instance will refuse to accept the packet (and it will trigger an alarm). Can Amazon sniff your packets? In theory a rogue employee could, but can they do it and get away with it, Amazon claims no. But if Amazon is considered a threat then they could pull packets out of memory or ev

Recommends John Rotenstein · 2020-09 · Stack Overflow · on “AWS VPC: How does route table redirect local traffic to the right subnet and instance?”

Amazon VPC is a virtualized network , also known as a software-defined network . Behind-the-scenes, VPC traffic is encapsulated and transferred across 'normal' network equipment, but the VPC defines a simplified set of rules that allow a network to be provisioned through clicks and API calls rather than connecting and configuring equipment. The simple answer to your questions is... It doesn't matter. As long as the network behaves correctly for how it has been configured, the implementation details are irrelevant. If you are interested in learning how networks in general operate, then I would recommend learning about Ethernet, TCP/IP and network routers. A VPC is higher-layer implementation

Recommends tinkertwain · 2021-03 · Server Fault · on “At what point Site-to-Site VPN encryption ends on the AWS side”

Per this video [LINK] Transit GW terminates VPN traffic at the perimeter of the VPC. This talk outlines what controls AWS has put in place to ensure VPC traffic isolation. ( [this video] )

Cites Amanuel Yohannes · 2023-06 · Stack Overflow · on “Do application and Database perform better if they are placed in the same subnet?”

In the physical world if we place 2 IP devices in the same subnet, they will be communicating on Layer 2 (ARP & MAC Address) and we are removing the layer 3 (IP) part of the communication. However in Amazon VPC, we use software defined network devices (Mapping Service) hence there is no impact on performance placing application and database in the same or different subnets. But in general we should remember to apply best practices when we deploy resources in terms of AZ for high availability and subnet segmentation for management and security. Here is a re:Invent link for more details (19min:15sec) [this video]