Virtual Test Access Points

VTAP sources and targets

The VTAP source is the resource the VTAP monitors. Traffic on this resource is mirrored and sent to a chosen target. The VTAP source and target must be hosted in the same VCN. They can be in different compartments or subnets provided you have the required permissions to view and work with these resources. VTAP sources can be:

• A single Compute instance VNIC in a subnet
• A Load Balancer
• A Database system
• An Exadata VM Cluster
• An Autonomous Database for Analytics and Data Warehousing instance using a private endpoint

For compute instances, specify the OCID of the attached VNIC. For the other source types, specify the service resource's OCID.

​The target is the resource that receives traffic mirrored from a VTAP. VTAP targets can be:

• A Network Load Balancer

This diagram shows a sample implementation of a VTAP.

In this example, the virtual machine in Subnet-A is sending traffic to another virtual machine in Subnet-B. The VTAP in Subnet-A checks traffic leaving the virtual machine. Since this traffic matches the capture filter in use, the VTAP mirrors the traffic to the target (in this case a network load balancer in Subnet-C). The backend set can then perform the appropriate analysis on the mirrored traffic.

Capture filters and rules

Capture filter rules select what is included in the traffic mirrored from the source to the target. Many VTAPs can use the same capture filter, so changing a capture filter's rules impacts all VTAPs that use that capture filter. A capture filter must have at least one rule, and can have up to 10 rules. Capture filter rules are examined in the sequence order you define. When a match is found, that rule is applied. If no match is found on a given rule, the next rule in the sequence is evaluated and run if matched. Reordering the rules can change the capture filter behavior.

A capture filter can take an action (either include or exclude a packet) based on the following types of criteria:

• The packet is part of ingress or egress traffic
• The packet is bound for or coming from a specific source or destination IPv4 CIDR block or IPv6 prefix
• The packet uses a specific IP protocol parameter (TCP or UDP port range, ICMP, ICMPv6) used by the traffic, or any protocols (using the default, All)

If a rule doesn't specify a CIDR block or prefix or IP protocol, all IP addresses or IP protocols are accepted for that rule.

Here's a working example of how you might structure a set of rules. The intent is that all traffic from 10.1.0.0/16 is included except 10.1.1.1, which is excluded:

1. Source CIDR: 10.1.1.1/32, Exclude
2. Source CIDR: 10.1.0.0/16, Include
3. Source CIDR: 10.1.1.0/24, Include

The capture filter evaluates each packet in the traffic against the rules in the defined sequence order. A packet from 10.1.1.1 matches the first rule and is excluded from the mirrored traffic. The packet is not compared against the other rules in the set. The rule set works as intended.

If the first rule is moved to be third in the sequence order, the set of rules no longer works as intended:

1. Source CIDR: 10.1.0.0/16, Include
2. Source CIDR: 10.1.1.0/24, Include
3. Source CIDR: 10.1.1.1/32, Exclude

Because the capture filter rules evaluate each packet in the traffic in the defined sequence order, a packet from 10.1.1.1 now matches the first rule and is included in the mirrored traffic. Further rule evaluations are skipped. This example uses CIDR blocks, but rules are evaluated the same way no matter which source type you choose.

For more information, see Capture Filters.

Advanced VTAP Features

VXLAN network identifier (VNI): Enter a VNI to uniquely identify the VXLAN encapsulation tunnel. If you don't specify a VNI, one is automatically generated for you.

Priority mode: Using this option gives equal priority to monitored and mirrored traffic when there is congestion at the source. By default, production traffic is prioritized ahead of VTAP mirrored traffic. When you enable priority mode, monitored traffic and VTAP mirrored traffic are given equal priority. When this option is selected, mirrored traffic might cause some monitored traffic to be dropped whenever the source is congested. If this packet loss is detected you can either disable priority mode or upgrade the source shapes to accommodate more bandwidth.

Requirements and Preparation

Implementing a VTAP requires at least one valid source and one valid target, both in the same VCN. These resources must exist before you create a VTAP. The target can be in different subnet than the source.

Dependencies

Working with VTAPs requires understanding some crucial dependencies:

• A VTAP must always have a source, a target, and an associated capture filter.
• A capture filter must always have at least one associated rule.
• A VNIC can't ever be a source for more than one VTAP. See VTAP sources and targets for more details.

You could see the following expected behaviors:

• You can't create a VTAP without designating a source and target and associating it with an existing capture filter. You can edit which capture filter is associated with the VTAP. You can't ever have a VTAP that doesn't have an associated capture filter.
• You're prevented from deleting a capture filter associated with a VTAP. To delete a capture filter that one or more VTAPs use, you need to associate a different capture filter to those VTAPs before you delete the capture filter.
• You're prevented from creating an empty capture filter or editing a capture filter to no longer contain any rules.
• If a VTAP source or target is deleted, the VTAP is automatically put into the STOPPED state. To restart a VTAP stopped for this reason, edit the VTAP to assign a new valid source or target, which causes the VTAP to be put back in the RUNNING state.

Required IAM Policy

Limits on IAM Resources

See VTAP Limits for a list of limits specific to this service.