Systems and methods for traffic shaping
Techniques for traffic shaping are described. In some examples, an ingress point receives traffic from a source and determines to send the traffic to a traffic shaper instance. The shaper instance is capable of performing one or more of a plurality of actions, wherein the plurality of actions include altering a shape of the traffic prior to sending the traffic to an original destination of the traffic, re-directing the traffic to a honeypot, allowing the traffic without doing altering action, and blocking the traffic.
1 . A computer-implemented method comprising:
configuring one or more rules at a traffic resolver instance, the one or more rules to dictate when traffic received at the traffic resolver instance is to be redirected to a shaper instance;
receiving traffic at the traffic resolver instance from a source of traffic;
determining, at the traffic resolver instance from packet metadata and telemetry data of the traffic, the traffic should be redirected to the shaper instance, the shaper instance capable of performing one or more of a plurality of actions, wherein the plurality of actions include altering a shape of the traffic prior to sending the traffic to an original destination of the traffic, allowing the traffic without doing altering action, redirecting the traffic to a honeypot, and blocking the traffic;
resolving, by the traffic resolver instance, addressing of the traffic such that a new destination for the traffic is the shaper instance;
sending, by the traffic resolver instance, the traffic to the shaper instance;
altering, by the shaper instance, a shape of the traffic, wherein altering the shape of the traffic does not alter a payload of the traffic;
sending the traffic to the original destination of the traffic; and
sending a response from the original destination of the traffic to the source of the traffic.
2 . The computer-implemented method of claim 1 , wherein the source of traffic is external to a cloud provider network.
3 . The computer-implemented method of claim 1 , wherein altering a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises selectively dropping an amount of individual packets of a traffic along a path to the original destination.
4 . A computer-implemented method comprising:
configuring one or more rules at a traffic resolver instance, the one or more rules to dictate when traffic received at the traffic resolver instance is to be redirected to a shaper instance, the shaper instance capable of performing one or more of a plurality of actions, wherein the plurality of actions include altering a shape of the traffic prior to sending the traffic to an original destination of the traffic, redirecting the traffic to a honeypot, allowing the traffic without doing altering action, or blocking the traffic;
receiving traffic at the traffic resolver instance from a source of traffic;
determining, at the traffic resolver instance from packet metadata and telemetry data of the traffic, the traffic should be redirected to the shaper instance;
resolving, by the traffic resolver instance, addressing of the traffic such that a new destination for the traffic is the shaper instance;
sending, by the traffic resolver instance, the traffic to the shaper instance; and
performing, by the shaper instance, one or more of the plurality of actions on the traffic.
5 . The computer-implemented method of claim 4 , wherein altering a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises selectively dropping an amount of individual packets of the traffic along a path to the original destination.
6 . The computer-implemented method of claim 4 , wherein altering a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises selectively dropping acknowledgement packets in a transmission control packet header of the traffic.
7 . The computer-implemented method of claim 4 , wherein altering a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises using a variable maximum segment size in a transmission control packet header of the traffic.
8 . The computer-implemented method of claim 4 , wherein altering a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises sending false reset (RST) packets to the source of the traffic.
9 . The computer-implemented method of claim 4 , wherein altering a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises invalidating a payload of a proper subset of individual packets from the traffic.
10 . The computer-implemented method of claim 4 , wherein altering a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises sending invalided transmission control packet header checksums.
11 . The computer-implemented method of claim 4 , wherein altering a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises altering transmission control packet header fields.
12 . The computer-implemented method of claim 4 , wherein determining the traffic should be redirected to the shaper instance comprises analyzing one or more of a source internet protocol (IP) address, a destination IP address, a source port, a destination port, and a protocol of the traffic in view of existing telemetry data for the source IP address.
13 . The computer-implemented method of claim 4 , wherein the source of traffic is external to a cloud provider network.
14 . The computer-implemented method of claim 4 , wherein the traffic resolver instance is a first traffic resolver instance, the method further comprising, after the shaper instance has performed the one or more of the plurality of actions on the traffic, sending, by the shaper instance, the traffic to a second traffic resolver instance that is different from the first traffic resolver instance.
15 . A system comprising:
a first one or more computing devices to implement a traffic resolver instance in the multi-tenant provider network, the traffic resolver instance including instructions that upon execution cause the traffic resolver instance to:
receive traffic from a source of traffic, wherein the ingress point traffic resolver instance is to be configured with one or more rules that dictate when traffic received at the traffic resolver instance is to be redirected to a shaper instance, the shaper instance capable of performing one or more of a plurality of actions, wherein the plurality of actions include to alter a shape of the traffic prior to sending the traffic to an original destination of the traffic, to redirect the traffic to a honeypot, to allow the traffic without doing altering action, and to block the traffic, and
determine, from packet metadata and telemetry data of the traffic, the traffic should be redirected to the shaper instance;
resolve addressing of the traffic such that a new destination for the traffic is the shaper instance;
send the traffic to the shaper instance; and
a second one or more computing devices to implement the shaper instance in the multi-tenant provider network, the shaper instance including instructions that upon execution cause the shaper instance to at least perform one more of one or more of the plurality of actions on the traffic.
16 . The system of claim 15 , wherein to alter a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises to selectively drop an amount of individual packets of the traffic along a path to the original destination.
17 . The system of claim 15 , wherein to alter a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises to selectively drop acknowledgement packets in a transmission control packet header of the traffic.
18 . The system of claim 15 , wherein to alter a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises to use a variable maximum segment size in a transmission control packet header of the traffic.
19 . The system of claim 15 , wherein to alter a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises to send false reset (RST) packets to the source of the traffic.
20 . The system of claim 15 , wherein to alter a shape of the traffic prior to sending the traffic to the original destination of the traffic comprises to invalidate a payload of a proper subset of individual packets from the traffic.