News for hackers. Stuff that matters.

A comment on Packets per Second Limitations in EC2. Parent comment

Re:Packets per Second Limitations in EC2 by john37386 on Saturday October 27, 2018 @04:13AM (#18314830)
By default, Amazon uses stateless firewall. It means that by default it's not tracking connections.
[ Parent | on HN ]
Re:Packets per Second Limitations in EC2 by spydum on Saturday October 27, 2018 @07:35AM (#18315307)
I think you may be mistaken. Security Groups are stateful: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Securit...

As suggested, it's very likely they hit the connection tracking limitation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-ne...

I've personally witnessed teams hit this specifically for DNS (usually for internal, where you have explicitly permitted src/dst).

[ Parent | on HN ]
Re:Packets per Second Limitations in EC2 by john37386 on Saturday October 27, 2018 @08:41AM (#18315472)
Yep I mistaken Security groups with Network Acl. Thanks. It's in the best practices to not track dns for big systems.

From powerdns https://doc.powerdns.com/recursor/performance.html

[ Parent | on HN ]
Re:Packets per Second Limitations in EC2 by gstaro on Saturday October 27, 2018 @09:04AM (#18315521)
Thx for the clarification. Had the same misconception
[ Parent | on HN ]