Amazon Technologies, Inc.

Joseph Elmar Magerramov

Richard Hazen Galliher, Iii

Anoop Dawani

Stewart Allen

Anthony Nicholas Liguori

Kevin Christopher Miller

Nishant Kanaiyalal Mehta

Lee Spencer Dillard

Diwakar Gupta

Marcin Piotr Kowalski

Colm Gearóid MacCárthaigh

Ethan Joseph Torretta

Andrew Davenport

Ciprian Dan Cosma

Moosa Muhammad

Andrew Bruce Dickinson

Harvo Reyzell Jones

Hardeep Singh Uppal

Brad Eugene Marshall

Jason Curtis Jenks

Nachiappan Arumugam

Dheerendra Talur

David James Goodell

Weinan Wang

Maxym Kharchenko

Venkat Maithreya Paritala

Min Zhu

Qiang Yu

David C Jernberg

Ganesh Subramaniam

Alessandro Gherardi

Bharadwaj Avva

Kiran Kumar Edara

Jacob Adam Gabrielson

Ishwardutt Parulkar

Rebecca Claire Weiss

Leslie Johann Lamprecht

Kaixiang Hu

Shane Ashley Hall

Igor A Kostic

Umesh Chandani

Joshua Marc Burgin

Kiran Kumar Meduri

Stephen Callaghan

Shuai Ye

Carl M Carter-Schwendler

Douglas Cotton Kurtz

Adithya Bhat

Shovan Kumar Das

Joby Sky Lafky

Cristian Gabriel Gafton

Mohamed Nader Farahat Hassan

Aaron D Kujat

John Matthew Nienart

Aaron Drew Alexander Kujat

Deepthi Chelupati

Gaurav Jain

Shubha Shree Bheemarao

Steven Bruce Richards

Abhijeet Pradeep Tirthgirikar

Aarthi Raju

Haider Witwit

William Hunter Hudson

Sergey Kolosov

Zachary Brandes

Apoorv Mittal

Ryan James Schaefer

Kiran Venkat Sayeeram Karpurapu

Ajay Jha

Nishant Mehta

Techniques are described that enable users to configure the mirroring of network traffic sent to or received by computing resources associated with a virtual network of computing resources at a service provider network. The mirrored network traffic can be used for many different purposes including, for example, network traffic content inspection, forensic and threat analysis, network troubleshooting, data loss prevention, and the like. Users can configure such network traffic mirroring without the need to manually install and manage network capture agents or other such processes on each computing resource for which network traffic mirroring is desired. Users can cause mirrored network traffic to be stored at a storage service in the form of packet capture (or 'pcap') files, which can be used by any number of available out-of-band security and monitoring appliances including other user-specific monitoring tools and/or other services of the service provider network.

Mirroring network traffic of virtual networks at a service provider network

The present disclosure generally relates to a first network device in a primary region that can failover network traffic into a second network device in a failover region. The first network device can receive routing criteria identifying how traffic originating in the primary region should be routed. The first network device can transmit this routing criteria to the second network device in the failover region. Based on determining the occurrence of a failover event, the first network device may transmit network traffic originating in the primary region to the second network device in the failover region. The second network device can determine how to route the network traffic based on the routing criteria of the primary region. In some embodiments, the second network device can determine how to route the network traffic based on the routing criteria of the failover region.

Systems and methods for enabling a failover service for block-storage volumes

A first set of network addresses of a first address family, and a second set of network addresses of a second address family, are assigned to a virtual machine. At a routing device, respective routing information entries for the two sets of network addresses are stored, without storing routing information entries for individual addresses of the sets. A first packet with a destination address within the first set, routed using the routing information entry for the first set, is obtained at the virtual machine. A second packet with a destination address within the second set, routed using the routing information entry for the second set, is obtained at the virtual machine.

Efficient propagation of routing information for compute instances with network address ranges of multiple address families

Techniques for compiling firewall rules into byte code or assembly code that can be loaded into cache memory of a processor and executed to evaluate received data packets. Rather than representing firewall rules in mid- or high-level languages stored in main memory, the techniques described herein include compiling the firewall rules into bytecode or assembly code, and distributing the code to the data plane. A packet-processing device may load the code representing the firewall rules into instruction cache of the processor. Further, the packet-processing device receives a data packet and extracts packet context data indicating attributes of the packet, and load the packet context data into a data cache of the processor. The processor can then execute the byte code or assembly code representing the firewall rules to evaluate the packet context data without having to access main memory to determine whether allow or block the data packet.

Compiling firewall rules into executable programs

Disclosed are various embodiments of a stateful network router. In one embodiment, a network data connection is intercepted between a first host and a second host on a network. First data packets from the network data connection sent by the first host to the second host are routed to a target network appliance. Second data packets from the network data connection sent by the second host to the first host are also to the target network appliance.

Stateful network router for managing network appliances

Disclosed are various embodiments that provide highly available data-processing network functions for radio-based networks. In one embodiment, a tunnel host consistently routes network traffic associated with a range of network addresses in a radio-based network to a first instance of a data-processing network function instead of a second instance of the data-processing network function. A problem with the first instance of the data-processing network function is then detected. Additional network traffic associated with the range of network addresses is redirected from the first instance of the data-processing network function to the second instance of the data-processing network function.

Highly available data-processing network functions for radio-based networks

Technologies are disclosed for monitoring network traffic using traffic mirroring. According to some examples, traffic mirroring allows customers to monitor traffic at different sources within a VPC. For example, a source may be any Elastic Network Interface (ENI) in their VPC, including elastic network interfaces (ENIs) on virtual machine instances, Network Address Translation (NAT) Gateways, Load Balancers, VPC endpoints, Internal Gateways, Transit Gateways, and more. Filters can be utilized to determine the network traffic to mirror. A customer may also configure to monitor real-time traffic with a monitoring appliance of their choice. With traffic mirroring, data traffic may be identified and sent to one or more target devices. Customers may monitor traffic within a VPC for content inspection, forensic analysis, troubleshooting, record keeping, and the like. Using traffic mirroring, customers can replicate VPC traffic, along with full payload data, without installing and managing agents on virtual machine instances.

Monitoring network traffic using traffic mirroring

A determination is made that messages from a first constituent service of an application are to be processed at a second constituent service. Networking configuration settings are generated such that a message originating at the first constituent service is directed to a traffic processing agent established by a traffic management service. In response to a receipt of a message from the first constituent service at the agent, one or more packets are delivered to the second constituent service.

Managed traffic processing for applications with multiple constituent services

Techniques for networking in provider network substrate extensions are described. A compute instance of an isolated virtual network is hosted by an extension of a provider network that is in communication with the provider network via a secure tunnel through a customer network. A request to establish communications between the isolated virtual network and the customer network is received at an interface to the provider network. A message to cause a gateway of the extension to route traffic between the isolated virtual network and the customer network is sent via the secure tunnel.

Networking in provider network substrate extensions

Indications of packet processing operations to be performed for packets of a resource group, as well as configuration settings of the group, are obtained. A packet that satisfies a requirement of the configuration settings and meets a fast path criterion is processed at a fast path node configured for the group. In response to determining that another packet does not satisfy a criterion for fast path processing, the other packet is transmitted to an exception path target.

Serverless packet processing service with configurable exception paths

Methods and apparatus that allow clients to specify custom network rules for their resource instances or network constructs in a provider network environment. Services and interfaces may be provided that allow a client to provide an executable module that implements custom rules for their resources, or alternatively to specify or select custom rules for their resources. The module may be installed on a host device, and may apply the custom rules to packets to and from the client's resources. Alternatively, the client-defined rules may be applied to packet flows according to the custom rules specified by the client and applied by a client rules service implemented on the provider network external to the host device or on a client resource instance on the host device. The custom network rules may, for example, extend or modify standard network rules for the client's resources on the host device.

Client-defined rules in provider network environments

Respective destination groups are provided to routing intermediaries associated with a packet processing application. The destination group comprises a set of fast-path packet processing nodes of a packet processing service to which the routing intermediaries are to transmit packets to be processed. After a determination is made that the set of fast-path nodes to be included in the destination groups has changed, the destination groups are modified gradually during an update propagation interval.

Packet processing service configuration change propagation management

Executable programs representing firewall rules for evaluating data packets

Growing community of inventors

Bellevue, WA, United States of America

Joseph Elmar Magerramov