Configuring the Cloud TAP Stitcher

You must deploy and configure the Cloud TAP stitcher to use Cloud TAP. Netskope distributes the Cloud TAP stitcher tool as a container image. The Cloud TAP stitcher container is deployed over a cloud host instance (i.e. virtual machine) running Ubuntu 20.04 or newer versions, or RHEL 8.10 or 9.5. This tool is responsible for pulling the traffic from cloud storage, stitching back connections, doing TLS decryption, and then exporting the traffic.

You can export to .pcap format or over the wire, using VXLAN and GENEVE protocols, to external NDR tools.

Deploying the Cloud TAP Stitcher

The Cloud TAP stitcher is available as a docker image that you must run on your machine. The following is a link to the docker container for the stitcher: https://hub.docker.com/r/nsteam/cloudtap-stitcher

Refer to Cloud TAP Stitcher Host Sizing to view the machine or host resource requirement for the Cloud TAP stitcher and the desired throughput.

Use the following commands to download the docker container:

# download latest version 

docker pull nsteam/cloudtap-stitcher:latest

# download specific version [version number]

docker pull nsteam/cloudtap-stitcher:[version number]

ubuntu@ip-[IP address]:~$ docker images

REPOSITORY                    TAG       IMAGE ID       CREATED       SIZE

nsteam/cloudtap-stitcher   latest    d080b2946cca   11 days ago   567MB

The following is a list of commonly used arguments for running docker containers. To learn more, see the Docker help documentation.

The following is an example command to run the Cloud TAP stitcher in continuous mode with /usr/bin/bash as an entrypoint to execute. The container will run in the background and will be removed automatically upon exiting. The container mounts are:

• The host (/home/ubuntu/ctap) to the container (/ctap), which has the credential files aws.json.
• The host (/var/log) to the container (/var/log) for the stitcher.log output.

docker run --rm -d --name ns-ctap-stitcher \
-v /home/ubuntu/ctap:/ctap -v /var/log:/var/log --entrypoint "/usr/bin/bash" \
nsteam/cloudtap-stitcher \
-c 'stitcher -n --log-progress /ctap -c /ctap/aws.json --aws-region="us-west-1" --provider aws -b traffic >> /var/log/stitcher.log 2>&1'

The Cloud TAP stitcher allows you to download traffic from cloud storage (e.g., AWS S3, GCP, Azure), then converts that traffic to export or upload the packets to the local or NDR in their original or decrypted form.

The Cloud TAP stitcher executable is installed in the container under /usr/bin/. Run docker psand locate the CONTAINER ID, then connect to the container by running docker exec -it CONTAINER ID bash. From inside the container run stitcher --help to view the full list of options. The core arguments are separated into two groups: input and output methods. Use the input options to control cloud import (e.g., cloud provider authentication. Use the output options to control output (e.g., protocol, format, etc.). When done working in the container type exit and hit enter to leave the container.

Running Modes

# Fetch 1 hour of data starting from Thu Jun 01 2023 22:00:00 GMT+0000

stitcher --provider gcp -b traffic --start-ts 1685656800 --end-ts 1685660400 -e export.pcap

# fetch and process the BLOBs once

stitcher --provider gcp -b traffic --geneve-host x.x.x.x

# running continuously to fetch new data

stitcher --provider gcp -b traffic --geneve-host x.x.x.x --continuous

# runing with crash recovery progress file in /tmp direcotry

stitcher --provider gcp -b traffic --geneve-host x.x.x.x --log-progress /tmp

Cloud Storage

Use the --provider option to configure the cloud providers that serve as the source of traffic for the Cloud TAP stitcher.

The Cloud TAP stitcher uses the same bucket name for both key and data by default (-b or --bucket). The Cloud TAP stitcher also uses the same credential files for both key and data by default (-c or --credentials). You can use different buckets for key and data (-k or --keylog-bucket). Optionally, you can also specify a separate credentials file for the keylog bucket (--key-credentials).

Amazon Web Services

For the data hosted in an AWS S3 bucket (--provider aws), you must provide the access credentials (--credentials), the bucket name (--bucket), and the region (--aws-region). The credentials value is a filesystem path to the JSON file in the container. To provide credentials for access to AWS S3, you can provide a JSON file on the Cloud TAP stitcher CLI with this method. 

Alternatively, you can assign an IAM role to the AWS EC2 instance instead of specifying a credentials file. Once the Cloud TAP stitcher is running on the instance and you grant the IAM role the necessary permissions to access the bucket, use the --default-aws-credentials option. The AWS SDK will automatically manage authentication based on the instance’s IAM role.

docker run --rm -d --name ns-ctap-stitcher \
-v /home/ubuntu/ctap:/ctap -v /var/log:/var/log --entrypoint "/usr/bin/bash" \
nsteam/cloudtap-stitcher \
-c 'stitcher -n --log-progress /ctap -c /ctap/aws.json --aws-region="INSERT_REGION_HERE" --provider aws -b traffic >> /var/log/stitcher.log 2>&1'

If you are using AWS PrivateLink, use the following options to configure access to AWS S3:

• To access AWS S3 via PrivateLink, use --s3-endpoint-url followed by the custom AWS endpoint URL for PrivateLink (e.g., https://bucket.vpce-xxxxxxx.s3.<region>.vpce.amazonaws.com).
• To disable the virtual host-style addressing for AWS S3, use --s3-disable-virtual-hosting. By default, this option is set to false.

Google Cloud Storage

For the data hosted in a Google Cloud Storage bucket (--provider gcp), you must provide the service account credentials (--credentials) and bucket name (--bucket) to the Cloud TAP stitcher. The credentials value is a filesystem path to the JSON file in the container.

After you grant the service account the permissions to access the bucket, when the Cloud TAP stitcher runs on the GCP VM, you can use --default-gcp-credentials instead of specifying the credential file. Google SDK automatically handles the authentication.

Microsoft Azure

For the data hosted in a Microsoft Azure Blob (--provider azure), you must provide the access credentials (--credentials) and the name of the Azure storage account (--storage-account) where your data is hosted. The credentials value is a filesystem path to the JSON file in the container. When Cloud TAP stitcher is runs on the Azure VM, and with a Managed Identify attached, it can use --default-credentials azure instead of specifying credential file. Azure SDK will handle the authentication automatically.

docker run --rm -d --name ns-ctap-stitcher \
-v /home/ubuntu/ctap:/ctap -v /var/log:/var/log --entrypoint "/usr/bin/bash" \
nsteam/cloudtap-stitcher \
-c 'stitcher -n --log-progress /ctap -c ctap/azure.json --storage-account INSERT_STORAGE_ACC_NAME_HERE --provider azure >> /var/log/stitcher.log 2>&1'

Output Modes

The Cloud TAP stitcher can export traffic data locally or upload the data to an NDR sensor that is located in the same cloud provider and region. For NDR, the Cloud TAP stitcher uses VXLAN or Geneve encapsulation to tunnel the traffic to the sensor:

• For VXLAN, use -v or --vxlan-host to specify the remote VXLAN endpoint.
• For Geneve, use -g or --geneve-host to specify the remote Geneve endpoint.

You can also export traffic from one stitcher to multiple NDR endpoints. The stitcher distributes traffic equally across the specified NDR endpoints.

• To specify multiple VXLAN endpoints, use --vxlan-hosts followed by the hosts, separated by commas (--vxlan-hosts <host1>,<host2>,<host3>, etc.)
• To specify multiple Geneve endpoints, --geneve-hosts followed by the hosts, separated by commas (--geneve-hosts <host1>,<host2>,<host3>, etc.)

The following is an example of specifying multiple Geneve endpoints:

--geneve-hosts 192.168.10.20,192.168.10.21

Netskope-Defined Geneve Options

When you configure Geneve encapsulation (-g), the Cloud TAP stitcher uploads the following Geneve options to an NDR sensor.

MTU Adjustment

(Optional) Due to the Cloud TAP stitcher using VXLAN or Geneve encapsulation to tunnel traffic, additional bytes will be added to the packet size. If necessary, you can adjust the maximum transition units (MTU) configuration to accommodate the increase in packet size and prevent IP fragmentation.

• For GCP and Azure, you can enable jumbo frames for optimal performance. This ensures that network interfaces can handle larger packet sizes with fragmentation. For more information on enabling jumbo frames, refer to the GCP or Azure documentation.
• If the exported packet size exceeds the default MTU, you can adjust the MTU of the docker host. For more information on modifying the MTU of a network interface, refer to the docker host documentation.
• You can also adjust the MTU setting of the docker container to match the MTU value of the docker host. To learn more on adjusting the MTU of the docker container, refer to the docker host documentation.
• If jumbo frames are enabled on the host, you can use the --net=host option to ensure that the container respects the host’s MTU settings and help prevent performance degradation due to MTU mismatches.

  docker run --net=host --rm -d --name ns-ctap-stitcher -v /home/ec2-user/ctap:/ctap -v /var/log:/var/log --entrypoint /usr/bin/bash nsteam/cloudtap-stitcher  -c 'stitcher -c /ctap/aws.json --aws-region=us-east-1 --provider aws -b ctap-stitcher-perf-lfs  -g 172.31.89.104 > /var/log/stitcher.log 2>&1'

  Note that this is one possible solution and other solutions are available. To learn more about other ways to adjust or inspect container MTU settings, refer to the docker host documentation on networking.

Transparent Mode

Some NDR vendors (e.g., ExtraHop) provide data decryption and accept original traffic and session keys. This is supported with the –-transparent option.

If you are using Geneve extensions, use the following options to control communicated time stamps:

• Use --with-timestamps to replay the original timestamps.
• Use --with-current-timestamps to produce current timestamps at the point of export. You can use this option for testing purposes.

To separate the ExtraHop management interface and data capture interface for higher throughput, use the following options to push the session keys and data to different interfaces:

• Use --extrahop-prod to specify the hostname for uploading ExtraHop NDR data.
• Use --extrahop-management-host to specify the hostname for uploading ExtraHop session keys.

Decryption Mode

By default, the traffic processed by the Cloud TAP stitcher is decrypted. You can upload the traffic directly to an NDR that accepts decrypted traffic. To export decrypted traffic with NDR, use the --with-decrypted option.

stitcher -c aws.json --provider aws --aws-region="us-west-1" -b traffic -g x.x.x.x -n \
--with-timestamps --with-decrypted

Filtering

The Cloud TAP stitcher can apply traffic filters when processing traffic, allowing for fine-grained slice exports. Each filter value is a pcap expression. For example, you can retrieve a slice of traffic from a given time and source.

# Fetch 1 hour of data starting from Thu Jun 01 2023 22:00:00 GMT+0000 for a single user
stitcher --provider gcp -b traffic \
  --start-ts 1685656800 --end-ts 1685660400 \
  --export-filter "host 1.2.3.4 and tcp port 443" \
  -e export.pcap

Scaling with Multiple Cloud TAP Stitcher Instances

You can distribute traffic copied from multiple origins (e.g., Netskope POPs) across multiple instances to achieve the desired scale.

To select the traffic sources or POPs to process, you can use wildcards with the --origin-filter option. Alternatively, you can use the --origin-filter-regex option to create more complex match patterns (e.g., including or excluding POPs) with regular expression syntax.

Wildcards

The following are examples of wildcards you can use with the --origin-filter option.

stitcher --provider gcp -c gcp.json -b traffic --origin-filter US-NYC* --extrahop-management-host 10.138.0.40 --extrahop-prod 192.168.10.2

The following is an example of using multiple wildcards to distribute the load across multiple instances.

stitcher --provider gcp -c gcp.json -b traffic --origin-filter US-* --extrahop-management-host 10.138.0.40 --extrahop-prod 192.168.10.2

stitcher --provider gcp -c gcp.json -b traffic --origin-filter IN-* --extrahop-management-host 10.138.0.40 --extrahop-prod 192.168.10.2

stitcher --provider gcp -c gcp.json -b traffic --origin-filter UK-* --extrahop-management-host 10.138.0.40 --extrahop-prod 192.168.10.2

Regex

The following are examples of regex patterns you can use with the --origin-filter-regex option.

Cloud TAP Stitcher Host Sizing

The following tables provide the Cloud TAP stitcher throughput with respect to different host instance types for each supported cloud provider.

For the Cloud TAP stitcher, Netskope recommends at least 80 GB of disk space, but you might require more depending on your retention strategy (e.g., a higher-throughput deployment can require more than 100 GB). To determine the CPU and memory required for the Cloud TAP stitcher, refer to your cloud storage provider’s official documentation.

Amazon Web Services

Google Cloud

Microsoft Azure