How I Just Significantly Improved Network Performance on AWS
Do this for the better good of the Internet and a speedier network for yourself
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Check out my series on Automating Cybersecurity Metrics | Code.
🔒 Related Stories: Network Security | AWS Security | Application Security
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I have been having some issues with VPC endpoints and ensuring that private traffic goes to private IP addresses as it should. Anyway, I just enabled VPC endpoints and BLOCKED all public IP traffic. I should not need any public IP responses since I’m only accessing my EC2 instance via remote access and all other responses from AWS CLI commands should come from private networks for what I happen to be doing at the moment.
After initially implementing this and adding the last VPC Endpoint the responses from the AWS CLI took forever. I initially thought the requests were going to time out.
But once everything kicked in — then all my networking — including my remote access and even local web requests — seems to be running way faster.
I took a look at the traffic bouncing off my EC2 instance with this change. You should see if you have similar hitting your public facing hosts and what it’s doing. At the very least, it’s slowing everything down.
I wrote about how to block and allow what is needed in NACLs in this post:
Here are the current offending IP addresses. There are quite a lot from Google Cloud. Also Palo Alto, Censys, Recyber — and HostKey.
You’re not helping if you call this “research” it’s just slowing own the entire Internet and making people’s jobs harder. I wish GCP would block this stuff to indiscriminate IP addresses — which is clearly not a pentest. It’s just an attempt to scan all of AWS which shouldn’t be allowed. Even if it is promoted in certain very expensive security classes.
Please stop.
This traffic is within about a 30 minute timespan or less. Imagine what you’d have in a longer timespan — with more than one EC2 instance. !!
You have network equipment and hosts and hypervisors at AWS getting hit with all of this and processing it. By blocking at the NACL you’re dropping it quickly with a stateless firewall — and as I’ve mentioned before, AWS is the only cloud that offers stateless firewall rules.
I really wish every customer on AWS would start doing this and we’d all benefit from a faster network.
Count | IP Address
1 104.244.78.62
1 106.12.108.76
1 107.152.37.65
1 107.170.251.41
1 109.205.213.116
2 109.205.213.134
2 109.205.213.38
2 109.205.213.50
2 109.205.213.74
1 112.6.212.233
1 114.132.157.36
1 120.77.94.200
1 128.199.106.150
1 128.199.231.152
2 13.214.173.166
1 137.184.183.61
1 138.68.153.47
1 138.68.185.122
1 138.68.208.29
1 138.68.73.38
1 139.144.239.78
1 139.59.178.140
1 139.59.189.217
1 140.249.43.69
1 141.98.11.60
1 14.215.51.69
1 143.198.105.202
1 143.198.111.66
1 143.198.76.165
1 143.42.0.20
1 143.42.173.101
1 147.182.166.153
1 147.182.195.94
6 147.78.47.227
1 157.245.214.113
1 157.245.53.109
1 159.65.25.170
1 162.142.125.138
1 162.142.125.176
2 162.142.125.177
1 162.142.125.178
2 162.142.125.179
2 162.142.125.180
1 162.142.125.181
4 162.142.125.183
1 162.142.125.184
3 162.142.125.185
2 162.142.125.186
1 162.142.125.187
2 162.142.125.188
1 162.142.125.189
1 162.142.125.245
1 162.216.149.10
1 162.216.149.103
1 162.216.149.11
1 162.216.149.110
2 162.216.149.111
1 162.216.149.117
1 162.216.149.12
1 162.216.149.120
2 162.216.149.130
1 162.216.149.147
1 162.216.149.149
1 162.216.149.16
1 162.216.149.178
1 162.216.149.179
2 162.216.149.18
1 162.216.149.197
1 162.216.149.199
1 162.216.149.211
1 162.216.149.220
1 162.216.149.223
1 162.216.149.231
1 162.216.149.236
1 162.216.149.242
2 162.216.149.251
2 162.216.149.253
2 162.216.149.31
1 162.216.149.48
1 162.216.149.52
1 162.216.149.64
1 162.216.149.66
1 162.216.149.82
1 162.216.149.95
1 162.216.150.10
1 162.216.150.105
1 162.216.150.115
1 162.216.150.154
1 162.216.150.156
1 162.216.150.161
1 162.216.150.171
1 162.216.150.175
1 162.216.150.181
1 162.216.150.185
1 162.216.150.19
1 162.216.150.190
1 162.216.150.191
1 162.216.150.197
1 162.216.150.205
1 162.216.150.211
1 162.216.150.212
1 162.216.150.218
1 162.216.150.222
1 162.216.150.226
1 162.216.150.229
1 162.216.150.234
1 162.216.150.249
1 162.216.150.30
1 162.216.150.38
1 162.216.150.47
1 162.216.150.48
1 162.216.150.58
1 162.216.150.87
1 162.216.150.94
1 162.216.150.99
1 162.243.138.37
1 162.243.145.22
1 165.154.100.58
1 165.154.164.21
1 165.22.2.142
1 165.232.149.149
1 165.232.154.144
1 167.172.87.205
1 167.248.133.129
1 167.248.133.162
1 167.71.54.223
1 167.94.138.104
1 167.94.138.131
1 167.94.145.23
1 167.94.145.24
1 167.94.145.25
1 167.94.145.92
1 167.94.146.21
1 167.94.146.29
1 167.99.179.68
1 167.99.187.19
1 167.99.189.254
1 170.187.163.114
1 170.187.163.90
1 170.187.165.219
1 171.34.176.79
1 176.111.174.110
1 176.111.174.80
1 176.111.174.82
1 176.111.174.85
1 176.111.174.86
1 176.111.174.87
1 176.111.174.89
1 176.111.174.95
1 176.111.174.98
1 178.128.33.23
1 178.62.73.215
1 179.43.142.43
3 18.217.171.6
3 18.217.229.233
1 183.136.225.29
1 183.136.225.5
1 185.156.73.107
7 185.156.73.57
1 185.156.73.89
1 185.224.128.17
1 185.224.128.184
1 185.233.19.245
1 185.81.68.102
3 185.81.68.93
1 192.241.193.21
1 192.241.217.35
1 192.241.236.11
1 193.163.125.42
1 193.35.18.15
1 194.187.177.38
2 194.26.135.128
1 194.26.135.31
1 194.26.135.33
1 198.199.109.66
1 198.199.110.8
1 198.199.95.90
1 198.199.97.30
1 198.199.98.14
1 198.235.24.11
1 198.235.24.164
1 198.235.24.185
1 198.235.24.215
1 198.235.24.224
1 198.235.24.24
1 198.235.24.44
1 205.210.31.12
1 205.210.31.139
1 205.210.31.149
1 205.210.31.162
1 205.210.31.194
1 205.210.31.22
1 205.210.31.232
1 205.210.31.252
1 205.210.31.31
1 205.210.31.39
1 205.210.31.67
1 205.210.31.74
1 205.210.31.92
1 205.210.31.99
1 209.159.153.74
3 213.226.123.61
1 24.199.118.48
1 24.199.97.232
2 35.203.210.100
1 35.203.210.105
1 35.203.210.122
1 35.203.210.123
1 35.203.210.125
1 35.203.210.128
1 35.203.210.131
1 35.203.210.136
1 35.203.210.14
1 35.203.210.140
1 35.203.210.144
1 35.203.210.149
1 35.203.210.153
1 35.203.210.155
2 35.203.210.163
1 35.203.210.166
1 35.203.210.17
1 35.203.210.170
1 35.203.210.177
1 35.203.210.18
1 35.203.210.206
1 35.203.210.207
1 35.203.210.216
1 35.203.210.232
1 35.203.210.235
1 35.203.210.242
1 35.203.210.245
1 35.203.210.250
1 35.203.210.29
1 35.203.210.3
1 35.203.210.30
1 35.203.210.38
1 35.203.210.40
1 35.203.210.42
1 35.203.210.44
2 35.203.210.45
1 35.203.210.52
1 35.203.210.58
1 35.203.210.60
1 35.203.210.71
1 35.203.210.72
1 35.203.210.75
1 35.203.210.77
1 35.203.210.84
1 35.203.210.9
1 35.203.210.90
1 35.203.211.104
1 35.203.211.105
1 35.203.211.108
1 35.203.211.116
1 35.203.211.123
1 35.203.211.13
2 35.203.211.131
1 35.203.211.134
1 35.203.211.135
1 35.203.211.139
1 35.203.211.148
1 35.203.211.160
1 35.203.211.167
1 35.203.211.174
1 35.203.211.198
1 35.203.211.20
1 35.203.211.213
1 35.203.211.223
1 35.203.211.238
1 35.203.211.29
1 35.203.211.31
1 35.203.211.42
1 35.203.211.47
1 35.203.211.49
1 35.203.211.55
1 35.203.211.61
1 35.203.211.70
1 35.203.211.72
1 35.203.211.73
1 35.203.211.75
1 35.203.211.76
1 35.203.211.78
1 35.203.211.79
1 35.203.211.84
1 35.203.211.85
1 37.44.238.191
1 42.192.153.150
3 44.213.45.216
1 45.128.232.115
1 45.128.232.118
5 45.143.200.50
1 45.33.110.79
1 45.33.65.81
1 45.33.84.124
1 45.56.85.254
1 45.79.171.201
1 45.79.186.176
1 45.79.191.178
1 45.79.92.218
1 51.15.25.171
2 52.95.16.30
2 52.95.18.19
2 52.95.20.19
1 61.182.50.11
1 64.225.102.86
1 64.227.43.180
2 67.217.57.54
1 68.183.34.9
1 71.6.165.200
1 77.90.185.160
1 77.90.185.164
1 77.90.185.168
1 77.90.185.171
1 77.90.185.175
1 77.90.185.176
1 77.90.185.177
1 77.90.185.180
1 77.90.185.202
1 77.90.185.71
1 81.161.229.43
1 8.209.68.21
1 86.109.5.33
1 87.249.164.87
1 89.190.156.176
15 89.248.163.109
1 89.248.163.200
1 89.248.163.245
1 89.248.165.85
2 91.191.209.198
64 91.218.115.175
1 91.240.118.77
1 92.63.197.157
1 92.63.197.90
1 92.63.197.91
2 92.63.197.92
1 92.63.197.93
2 92.63.197.94
1 94.102.61.28
1 94.102.61.3
1 94.102.61.39
2 94.102.61.41Biggest offender — Hostkey
But all this traffic from Google Cloud is pretty bad too.
All the above are coming from this IP range.
Now if you have any problems with VPC Endpoints slowing you down after implementation, that’s because there’s what is in my opinion a bug, but in the way DNS addresses resolve at the moment, but here’s how you can troubleshoot and fix issues with VPC endpoints.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2023
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for PresentationFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab