Duplicating UDP Traffic in AWS

What is UDP Traffic Duplication?

UDP traffic is stateless—meaning when a client sends a message, it doesn't track whether that message actually reached its destination.

Traffic duplication is exactly what it sounds like: taking a single incoming stream of traffic and cloning it so it can be sent to multiple destinations simultaneously.

Why Duplicate UDP Traffic?

When you spin up a new destination host, you often need both the old and new hosts to receive the exact same traffic stream. Rather than forcing your client application to send identical messages twice, you can use a UDP duplication appliance to clone and route the traffic in real-time. It's cleaner, faster, and saves client resources.

Step-by-Step Setup Guide

Getting UDP duplication running in AWS is straightforward:

1. Deploy the Traffic Duplicator appliance from the AWS Marketplace.
2. Disable source/destination checks on your Traffic Duplicator instance.
3. SSH into the appliance and open the configuration file:

   nano /etc/trafficduplicator/trafficduplicator.config
   

4. Update the JSON file to match the forwarding rules you need. For example, if you want to duplicate an inbound syslog stream and send it to two different rsyslog servers, you just set the SOURCEPORT and list the targets in DESTINATION:

   {
       "DuplicateSyslog" : {
           "SOURCEPORT" : "514",
           "DESTINATION" : ["172.31.63.131/514", "172.31.62.154/514"]
       }
   }
   

5. Save your changes and reboot the appliance.
6. Point your client-side configurations to send their UDP traffic (like syslog data) to the Traffic Duplicator.
7. Finally, check your destination servers to ensure they're receiving the cloned traffic.