Sorry for the stupid question, but I just want to make sure I understand Private IPs. So if I have two Linodes with private IPs, clearly any traffic between the two is hidden from the Internet, but is it hidden from other Linodes in the same data center? Or on the same subnet?

In other words, do I need to encrypt private IP traffic between my two Linodes, or is it impossible for anyone else to sniff my private IP traffic?

No it's not accessible from the Internet

Private Network

As for internally, you really do need take measures, I may be mistaken but everyone within Linode's network in that data center would be visible.

_________________

Where "Thought Crime" is commited
http://www.rejecttheherd.net

iirc, your internal (private) interface(s) are visible to other linoden in your datacenter. it's up to you to lock it down.

Because of the way caker has the linode networking stuff set up, no linode can see the traffic that isn't explicitly destined for it.

well, that's comforting

Thought I would maybe clarify this a bit.

You DO need to secure your ports because anyone in your datacenter can connect to services you make available via the private network.

So you should only allow IPs which you expect to communicate with.

So don't leave your memcached server exposed so that someone can come across it on a port scan and steal your data over the private net.


However, they have promiscuous mode turned off, and no broadcast/multicast stuff so you don't need to worry about someone sniffing your traffic as it goes across the wire.

(Sorry for the partial quote)

Broadcast is certainly enabled -- whoever has 192.168.139.100 in the Atlanta DC seems to enjoy Samba on their Linode and I keep seeing all the damn MS protocol broadcasts traffic on my Linode:

[IPTABLES REJECT] : IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:fe:fd:40:16:47:15:08:00 SRC=192.168.139.100 DST=192.168.255.255 LEN=243 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=223 
[IPTABLES REJECT] : IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:fe:fd:40:16:47:15:08:00 SRC=192.168.139.100 DST=192.168.255.255 LEN=235 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=215 
[IPTABLES REJECT] : IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:fe:fd:40:16:47:15:08:00 SRC=192.168.139.100 DST=192.168.255.255 LEN=243 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=223 
[IPTABLES REJECT] : IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:fe:fd:40:16:47:15:08:00 SRC=192.168.139.100 DST=192.168.255.255 LEN=235 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=215