Packet Mirroring
GCP’s Packet Mirroring feature allows security teams to collect network packets from VMs and identify security threats or activities associated with the VMs. GCP’s Packet Mirroring only mirrors traffic between VMs and external interfaces and does not mirror traffic between cluster nodes such as GKE. We will learn more about containers, including Docker and Kubernetes, in Chapter 11.
To mirror packets, ensure the principals are attached with the compute.packetMirrorUser
and compute.packetMirroringAdmin
roles.
An internal load balancer must be deployed with network passthrough capabilities that pass the traffic to the collector instances to enable packet mirroring. The load balancer must be pointed to a managed instance group in the backend with pre-configured instance templates, allowing GCP to create collector instances automatically. The collector instance can be a VM with tools for capturing and receiving network packets via the internal load...