Skip to main content
Traceable Documentation

Set up VPC mirroring directly with a VM

Saad Farooq
  • Updated

 

Purpose

This document lists the steps to setup a VM mirroring monitoring in an AWS environment. This will enabling listening to the traffic on a given VM instance, and report to the Traceable Platform Agent. The steps documented below would install Traceable Platform Agent, and setup Traffic Mirroring for the VM Instance.

 

Prerequisites

This method of instrumentation uses the VPC Traffic Mirroring feature of AWS to mirror the traffic and report to the Traceable Platform Agent. The process would need the following things and should be available beforehand:

  1. VPC of the Subnet which contains the VM whose traffic is to be mirrored.
    • Eg - vpc-04e12852152ba897f
  2. Subnet ID of the subnet to which the VM is connected to and whose traffic is to be mirrored.
    • Eg - subnet-053ab9eaa6f70d42d
    • _2.png
  3. Network Interface ID of the Network Interface attached to the VM to be monitored.
    • Eg - eni-03e5121995324a00e
    • ENI.png
  4. Traceable Refresh Token
    • Copy the Refresh Token from the Traceable Platform and keep it handy through the instrumentation process. Either generate a new token, or use an existing token.
    • tokengen.png
    • Create a Secret in the AWS Secret Manager for this token generated in step (a)
    • secret.png
  •  

The name of the Key should be refresh_token.

 

Install

Initiate CloudFormation Template

The CloudFormation Template can be initiated at:

https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?stackName=Traceable-Mirroring&templateURL=https://s3.amazonaws.com/downloads.traceable.ai/install/traffic-mirroring/cf-template/latest/template.yaml

template1.png

template.png

create-stack.png

Cloudformation Stacks

This initiates the CloudFormation Template which will create the required resources.

target.png

VPC Mirror Targets

Ensure that VPC Mirroring Target is created.targets.png

VPC Mirror Filter

Ensure that the VPC Mirror filter is created

filters.png

Create A New Mirror Session

In the VPC-> Traffic Mirror Sessions console create a new Mirror Session.

setup-mirror.png

mirrorsesh.png

 

Update Traffic Mirror Filter

The Cloudformation Stack creates a Blank Filter that will be used by the Mirror Session to Mirror the traffic on the given Network Interface. Specify the Inbound and Outbound rules in the created Traffic Mirror Filter. This would define which Inbound and Outbound Network calls should be mirrored (and consequently Monitored) by Traceable.

Ingress Mode

The images below provide a simple sample of rules defining inbound and outbound traffic on a single port. The actual rules will depend on the Application or Service being monitored and should be defined appropriately. The example below will primarily capture the ingress traffic to the application hosted on the VM

Sample Inbound Rule for Ingress Capture:

filter-detail.png

Sample Outbound Rule for Ingress Capture:

outbound.png

 

Egress mode

The following is an example of capturing only the Egress traffic from the application hosted on the VM. The images below show sample inbound and outbound rules for the egress configuration:

Sample Inbound Rules for Egress Capture

Inbound_Rules.png

 

Sample Outbound Rules for Egress Capture

Outbound_Rules.png

Validate Setup

Traceable Platform Agent

Validate EC2 Instance

One the setup is successful you should see the EC2 instance created for the Traceable Platform Instance:

ec2.png

Validate Agent Logs

You can log into the machine and verify the logs to see that there are no errors seen in the logs.

 

Before you can log in to the machine, you would need to add inbound rules to the associated Security Group to allow incoming SSH connections. Please refer to the following screenshots for an example of how to add the in-bound rules to allow ssh access to the VM:

secgroup.pngsecrule.png

Once SSH Access has been has been allowed, run the following to connect to the EC2 instance and check the logs

$ ssh ec2-user@ec2-xx-xxx-xxx-xxx.compute-1.amazonaws.com
$ cd /var/traceable/log/
$ tail -f `ls -rt traceable.* | tail -1`
……
{"level":"info","time":"2022-04-20T04:40:14.217Z","message":"Stats","service":"ext_cap","total":"12814","post":"350","get":"12480","put":"0","delete":"0","head":"0","other":"0","20x":"12245","30x":"225","40x":"0","50x":"0","RCother":"370","total_blobs_read":"13433","queued_work":"0","active_routines":"0","queue_capacity":"5000","http1x":"12818","http2":"0","grpc":"0","errors":"585","filtered":"0"}
{"level":"info","time":"2022-04-20T04:45:14.217Z","message":"Stats","service":"ext_cap","total":"13689","post":"371","get":"13334","put":"0","delete":"0","head":"0","other":"0","20x":"13075","30x":"245","40x":"0","50x":"0","RCother":"395","total_blobs_read":"14350","queued_work":"0","active_routines":"0","queue_capacity":"5000","http1x":"13693","http2":"0","grpc":"0","errors":"626","filtered":"0"}

 

Traceable Platform

When the instrumentation is successful, you should see the Environment and the Service created, and the API End-points detected.

traceableui.png

Issues with Setup

In case any issues are observed with the setup (Data not reporting, errors in the logs etc.) please reach out to Traceable at support@traceable.ai.