K2 Cloud Adds Native OVN Traffic Mirroring for NTA/NDR Deployment in Public Cloud

K2 Cloud has become the first Russian public cloud to support native traffic mirroring from virtual-machine interfaces for NTA/NDR systems. The implementation was achieved by extending OVN overlay-network capabilities and contributing the changes upstream, where the patch was accepted into the main code base.

Why cloud traffic visibility was missing

Until this development, no Russian public cloud offered the ability to mirror VM traffic. PT Network Attack Discovery (PT NAD) from Positive Technologies and similar tools require an exact copy of network packets to perform signature analysis, indicator-of-compromise checks, sandbox integration, and behavioral anomaly detection. Without this copy the systems cannot function.

How the mirroring works

Mirroring is performed after the packet has passed the load balancer and cloud firewall for inbound traffic, and immediately after the VM for outbound traffic. The original packet continues to its destination while an identical copy is sent to the designated PT NAD sensor. The feature operates across any project networks, including different VPCs, and mirrors exactly the same traffic that would be seen by tcpdump inside the VM.

Filters solve duplicate, one-sided, and elephant-flow problems

• Inbound filter rules drop traffic originating from other VMs inside the same VPC to prevent duplicate packets from reaching the sensor.
• Outbound rules explicitly allow traffic to the default gateway so that DNS and DHCP sessions remain complete.
• Heavy but legitimate flows such as backups can be excluded by IP, port, and protocol to reduce sensor load.

Filters are applied only to the cloned packets and have no effect on the original traffic.

Operational constraints and performance

Mirroring is limited to a single availability zone; each additional zone requires its own PT NAD instance. Load testing conducted jointly with Positive Technologies demonstrated more than 3 Gbit/s of mirrored HTTP traffic, roughly 400 000 packets per second, and 30 000 HTTP transactions per second with negligible packet loss. The official PT NAD rating is 2 Gbit/s; higher rates are achievable with multiqueue configuration on the capture interface.

Deployment notes

Administrators must remove the automatically assigned IP address from the capture interface by uninstalling the c2-ec2-netutils package, otherwise the DPDK-based sensor will not start. Disk IOPS should be monitored when raw traffic storage is enabled. All resources—sources, destinations, sessions, and filters—can be managed through the web console, the EC2-compatible API, or the K2 Cloud Terraform provider.