Advanced approaches to traffic inspection & network diagnosis w/
summary
Shows how to combine specific AWS features to inspect packets and diagnose slow or noisy networks: use VPC Flow Logs (1–10 minute intervals, Nitro supports 1 minute) and the latest flow-log version to stitch multi‑hop sessions; feed GuardDuty findings into Athena to find bursts (example: 500+ port hits in a 10‑minute window); capture raw packets with Traffic Mirroring (VXLAN encapsulation → NLB → Suricata autoscaling), noting mirrored traffic counts against instance bandwidth and drops under congestion; centralize filtering with Network Firewall or Gateway Load Balancer + Transit Gateway or PrivateLink.
AI-written summary · about
chapters (19)
- 0:00Agenda
- 7:28Flow logs
- 11:56Guard Duty finding
- 14:06AWS WAFF
- 16:51Traffic Mirroring
- 22:14Traffic Mirroring Considerations
- 26:06More use cases
- 26:46What to consider
- 28:58Security
- 31:17Network Firewall
- 32:41Network Firewall capabilities
- 33:45How Network Firewall works
- 35:37Distributed Deployment Model
- 37:35Centralized Deployment Model
- 41:03Deployment Across Regions
- 43:16Centralized VPC
- 46:02Combined deployment model
- 47:08Gateway Load Balancer
- 48:35When to use one
related talks
47mNetwork operations management and governance
54mAssuring and securing AWS migrations
51mNetwork inspection design patterns that scale
25mSilicon and Networking
44mElevando la postura de seguridad con AWS Network Firewall
49mVisibility Without Borders: NETSCOUT to help migrate apps to
29mFinding the Needle in a Haystack: Tenant-Level Network...
50mAWS Well-Architected for network security