Your
infra.
Structures from the field, scaled down so you can move them yourself. Every value here is an illustrative simulation.
DISPLAY / CONTROL
Changes how this theme looks. Settings stay in this browser only.
Current settings:
Settings apply instantly.
See the work with these settings ↗DDoS auto-block
When the request count in the logs crosses a threshold, the source is blocked automatically. Change the attack size and the threshold.
01 / NO RULENo rule
Server overloaded
02 / AUTO BLOCKAuto-block
Source blocked, service normal
Instead of someone waking up at night to read logs and block, aggregation and the block rule become one automatic flow.
- T+0 Attack starts
- T+1 Logs aggregated
- T+2 Threshold crossed
- T+3 Block rule added
- T+4 Back to normal
Simulation only. These are not measurements from a real service.
GKE node upgrade
max_surge is how many new nodes start first; max_unavailable is how many old nodes leave at once. Together they decide capacity during the upgrade.
Old nodeNew nodeTemporary surge node
01 / CAPACITYLowest available nodes during upgrade
6 / 6
OK
02 / ROUNDSReplacement rounds needed
2
—
With max_unavailable at 0, old nodes leave only after new ones are ready, which suits services like game servers that must not drop.
Simulation only. These are not measurements from a real service.
Terragrunt run-all order
The module dependency graph of pf-04. run-all starts with modules that have no dependencies and runs each level together.
01 / SERIALOne at a time
16
Run waves
16 modules
02 / RUN-ALLrun-all by dependency level
4
Run waves
Level 0 / 4
The apply order that used to be handled per copy is now decided by the dependency graph.
- Level 1 iam_custom_policy · vpc · elastic_ip · ebs
- Level 2 iam_user · iam_custom_role · internet_gateway · security_group · vpc_endpoint · vpc_peering · elasticache_subnet_group · nat_gateway
- Level 3 iam_group · route_table · instance_profile
- Level 4 ec2_instance
Simulation only. These are not measurements from a real service.
Firewall priority matching
Send one packet. Rules are compared from the lowest priority number, and only the first match applies.
01 / PRIORITY By priority (what really happens)
- 100 Allow Admin network 22
- 200 Deny Any 22
- 300 Allow Any 443
- 400 Allow Game client 7000
- 1000 Deny Any Any
First matching rule: —
02 / DECLARED By written order (a common misreading)
- 300 Allow Any 443
- 100 Allow Admin network 22
- 400 Allow Game client 7000
- 200 Deny Any 22
- 1000 Deny Any Any
First matching rule: —
When the order rules are written in differs from the order they are evaluated in, an unintended rule applies first.
Simulation only. These are not measurements from a real service.
Reachability check
Pick a source, destination and port. The check follows the same order as the real operations tool (source security group outbound → destination security group inbound → routing) and finds where it stops.
01 / CHECKSSource security group outbound → Destination security group inbound → Routing
- 1 Source security group outbound Not checked
- 2 Destination security group inbound Not checked
- 3 Routing Not checked
- 4 NACL Practice-only extra step (the real tool does not check this) Not checked
02 / VERDICTVerdict
—
—
When someone asks to "just open it", finding which step blocks is the fastest way to the real problem. If routing is the cause, opening the security group only adds unnecessary allow rules.
Simulation only. These are not measurements from a real service.