A capture on the node uplink sees VXLAN-encapsulated traffic — what can an IDS match on, and what does recovering the inner session cost?

## What is actually on the wire An overlay hides a workload network inside a node network. With VXLAN, the node takes the workload's original Ethernet frame, wraps it in an 8-byte VXLAN header carrying a 24-bit segment identifier (the VNI), puts that in UDP with destination port 4789, and puts that in an IP header addressed from this node's tunnel endpoint to the destination node's tunnel endpoint. GENEVE does the same job on UDP port 6081 with an extensible option field. The receiving node strips the envelope and delivers the original frame to the destination workload's virtual interface. So a passive capture on the node's uplink sees, per packet: - **outer IP** — which two *nodes* are talking; - **outer UDP** — that this is overlay traffic (4789 / 6081), plus an entropy-carrying source port used for load balancing, not identity; - **VXLAN header** — which overlay *segment* the frame belongs to; - **payload** — the whole real conversation, one layer down. ## What an IDS matches on if it does not decapsulate Only the envelope. That means the sensor's view of an estate with hundreds of workloads is a small mesh of node-to-node tunnels carrying enormous byte counts. Signatures keyed on ports, hostnames or protocol structure match nothing, because the protocol on the wire is UDP-to-4789 in every direction. An intruder pivoting from one workload to another on a different node produces a few extra kilobytes inside a tunnel that already carries megabytes per second, and the sensor cannot tell one conversation from another inside it. ## Decapsulation is available, and it does not give you identity Most sensors will decapsulate VXLAN and inspect the inner frame; some can be told to decapsulate several layers. This costs parsing CPU on every packet, and it is the difference between a sensor being useful on this network and being decorative — but it recovers **addressing**, not **identity**: - The **VNI is a segment identifier.** It tells you which overlay segment, not which workload, team or application. - Inner addresses are **ephemeral**. A workload address is assigned at start-up and reused after the workload dies, often within minutes on a busy platform. An address in a capture from last Tuesday belongs to whatever held it last Tuesday. - Naming the two endpoints therefore requires **joining to the platform's address-assignment records at the timestamp of the flow**. If those records are retained for hours and your capture for weeks, half of your capture is unattributable, and an investigation that arrives late gets addresses and nothing else. That join is the hidden price of overlay sensing, and candidates who have not done it usually miss it entirely. ## Node-to-node encryption closes the envelope Many platforms can encrypt node-to-node traffic — ESP between the nodes, or a WireGuard-style tunnel. Then the uplink carries encrypted packets between node pairs: you see the node addresses, a security-parameter index and a sequence number, and byte counts. The overlay header, the inner addresses and the payload are all inside the encryption. Expecting to decrypt that from a passive copy is a misunderstanding: the keys are negotiated per node pair with ephemeral key exchange and are not sitting anywhere the sensor can read them. The consequence is structural rather than tunable. Once node-to-node encryption is on, **the wire is finished as a vantage** for anything below node granularity. The only remaining position is inside the node kernel, at the workload's virtual interface, before encapsulation on egress and after decryption on ingress — which is a sensor per node, on production CPU, in the data path. ## The honest statement to an interviewer Say what each position yields and what it costs: | position | what it yields | what it costs | | --- | --- | --- | | uplink capture, no decap | node pairs and tunnel volume | almost nothing, and it is almost worthless for lateral movement | | uplink capture with decap | inner 5-tuple and payload, unattributed | parsing CPU, plus a join to address-assignment records that expire | | in-node capture | plaintext inner packets with workload context | a sensor per node in the production data path | | any of them, after node-to-node encryption | node pairs and volume only | the wire vantage is gone entirely | The security point is that an intruder does not need to do anything to earn this blindness. It is the platform's normal configuration, chosen for mobility and confidentiality, and it removes the sensing position as a side effect.