East-west sensing on 300 nodes to catch an intruder's lateral hops: what grows fastest, and what does it consume?

## The perimeter number does not transfer Perimeter sensing is easy to size because it is bounded by a link you bought: one or two aggregation points, a known bandwidth, one place to put the sensor. Every one of those properties fails inside. **Capture points scale with nodes.** There is no interior chokepoint on a container platform. Traffic between workloads either stays inside a node or crosses the fabric as node-to-node tunnels; neither passes a place you can put one sensor. So the count of capture points is the count of nodes, and it grows every time the platform scales out. Three hundred nodes is three hundred deployments, three hundred upgrade targets, and three hundred things that can silently stop. **Volume is the interior, not the edge.** North-south traffic is the small end of a service estate. Interior traffic includes service-to-service calls that fan out several deep per user request, database replication, cache traffic, health checks, service discovery, log and metric shipping. On a service-heavy platform it commonly runs several times the internet-facing volume, and none of the usual budgeting instincts account for it because nobody ever paid for it as bandwidth. **Most of it is worthless to inspect.** A large fraction of interior bytes is replication and telemetry between two components that will never be an intrusion path in the way you care about. Paying full inspection cost for those bytes is the fastest way to run out of budget before you have covered anything interesting. ## What breaks, in order 1. **Node CPU.** Capture, reassembly and matching run on the same cores the scheduler is handing to workloads. Platform owners notice this immediately, because it shows up as reduced schedulable capacity — you are asking for a percentage of the whole fleet. 2. **The uplink you are monitoring.** If the sensor ships raw copies off the node, interior traffic now traverses the fabric twice. On a busy node this is self-defeating: the copies compete with the production traffic you exist to protect. 3. **Aggregation and analysis.** Even filtered, three hundred feeds converge somewhere, and that somewhere is now sized for interior volume rather than edge volume. 4. **Storage.** Anything you want to be able to look back at multiplies retention by the same factor. ## The lever that actually works: reduce before you ship The design that survives does its reduction **on the node**, in the capture path, before anything crosses the uplink: - drop the known-uninteresting talkers by address or port at the hook itself; - keep full packets only for a defined set of paths, and summaries for the rest; - run detection locally where the logic is cheap and ship the verdict rather than the bytes. That converts an unbounded bandwidth problem into a bounded per-node CPU budget, which is a number the platform team can be asked to approve. ## Node density cuts both ways A densely packed node hides more traffic inside itself, so instrumenting it buys more coverage per sensor — and costs more CPU, because more of the estate's traffic is passing through that kernel. Sparse nodes are cheap to instrument and buy little. When you can only fund a fraction of the fleet, density is a real selection input, and it is the one people forget. ## Where this lands The arithmetic does not converge on full coverage; it converges on tiers. A workable shape is: full inspection on a small set of nodes or segments chosen deliberately, header-level records on a wider set, and an explicit nothing on the rest. That third category is not a failure to be hidden — it is the thing you have to write down, because an intruder whose entire lateral path stays inside one unsensed segment crosses nothing you instrumented, and the absence of any record from that path is what someone will later ask you to explain. A candidate who answers this by quoting a sensor's rated throughput has missed the question. The rated throughput is the last constraint you hit; node CPU and backhaul are the first two.