K2 Cloud has implemented traffic mirroring for virtual machines within its OVN-based overlay network. This functionality allows for the deployment of NTA/NDR systems, such as Positive Technologies' PT Network Attack Discovery (PT NAD), which previously lacked access to network traffic copies in Russian public clouds.
The solution was developed by K2 Cloud and integrated into the OVN upstream codebase. The system operates by cloning traffic from a source virtual machine interface to a sensor interface. It supports filtering to eliminate duplicate packets, reduce sensor load, and manage traffic distribution, with configurations manageable via web console, API, or Terraform.
During load testing conducted with Positive Technologies using HTTP traffic, PT NAD demonstrated performance exceeding its official specification of 2 Gbps. Higher throughput can be achieved by configuring multiqueue for the sensor's network interface.
The implementation requires specific configurations: mirroring is restricted to a single availability zone, necessitating separate sensors for multi-zone setups. Additionally, users must remove IP addresses from capture interfaces to prevent conflicts with DPDK, and monitor disk IOPS to ensure performance during high traffic volumes.
