AWS vpc: Warn that VNI is unauthenticated for traffic attribution
Summary
Added an Important note advising use of the outer source IP address (protected by EC2 anti-spoofing) rather than the VXLAN Network Identifier to attribute mirrored traffic to a mirror source.
Security assessment
Documents that the VNI is a caller-chosen, unauthenticated label that can collide across accounts sharing a target, so relying on it for attribution could misattribute or be spoofed; recommends the anti-spoofing-protected outer source IP instead.
Evidence
+When you analyze mirrored traffic, use the outer source IP address of the encapsulated packets to attribute the traffic to the correct mirror source. Do not rely solely on the VXLAN Network Identifier (VNI) to attribute traffic. The VNI is a caller-chosen, unauthenticated label. The VNI is not guaranteed to be unique across sessions from different accounts that share the same target.
Diff
diff --git a/vpc/latest/mirroring/traffic-mirroring-getting-started.md b/vpc/latest/mirroring/traffic-mirroring-getting-started.md index 4cd87be..1fbb2f0 100644 --- a//vpc/latest/mirroring/traffic-mirroring-getting-started.md +++ b//vpc/latest/mirroring/traffic-mirroring-getting-started.md @@ -157,0 +158,6 @@ After the mirrored traffic is copied to the traffic mirror target, you can use a +###### Important + +When you analyze mirrored traffic, use the outer source IP address of the encapsulated packets to attribute the traffic to the correct mirror source. Do not rely solely on the VXLAN Network Identifier (VNI) to attribute traffic. The VNI is a caller-chosen, unauthenticated label. The VNI is not guaranteed to be unique across sessions from different accounts that share the same target. + +The outer source IP address is set to the primary IP address of the source network interface, and it is protected by Amazon EC2 anti-spoofing. This makes the outer source IP address the reliable value for identifying the origin of mirrored traffic. +