Multiple IPs for EC2 Instances

Amazon recently announced an increase in their IP Address limits for single EC2 instances. At first glance this looks like big news for anyone who runs a honeypot on EC2. My research has found that it's not quite as good as it sounds but there are definite benefits for anyone with a little cash to spend.

Up until recently it has not been possible to have more than 1 IP Address associated with your EC2 instance*. As someone who runs a Dionaea Honeypot on EC2 I have been looking for a way to get multiple IP addresses pointed at my instance for a while now.

Which is why I was quite excited when Amazon announced that they would now support up to 240 IP Addresses per single EC2 instance. That figure actually refers to private IPs, but in AWS land a private IP can have a public IP pointed at it. So this sounds like big news for anyone running a honeypot on an EC2 instance; more IPs means more interesting honeypot data. 240 IPs means a crap load of interesting honeypot data.

Unfortunately it's not quite as simple as that. The 240 IP limit only applies to the rather expensive High-Memory Quadruple Extra Large ($1317.60 a month) instance. Smaller instances have smaller limits. The smaller amounts are as follows:

• Micro: -
• Small: 8
• Medium: 12
• Large: 30

source

As you can see that means that anyone hoping to get multiple IPs on their free tier micro instance are out of luck.

For those thinking that 30 IPs is not too bad and they may splash out on a large, there's a further limitation from Amazon. They limit EC2 users to 5 IP Addresses per account. Fortunately, you can request an increase, which is exactly what I did. I found that there wasn't a need for too much detail, my e-mail looked something like this:

Hi

I am looking to increase my IP limit, please, I need a higher amount for the security research that I use my EC2 instances for. Ideally I would like 240 but will be grateful for a smaller amount if that isn't possible.

Thanks

Amazon raised my limit to 20 IP addresses. In this day and age to IPv4 exhaustion I suppose 20 is not to be sniffed at but it could be better, maybe if I made a stronger case in the future (or had more paid instances..) I would get more but it's hard to tell.

In conclusion, Amazon's recent limit increase is only big news for big spenders. It's not possible to just grab 240 IP and point them at your free tier micro instance. If all you want is a few more IPs then it's probably more cost effective to grab a budget VPS.

However, if you want the flexibility of EC2 then this may be worthwile. The great thing about EC2 is the flexibility. You can grab those IPs and release them as you like. So if there was some particularly interesting vulnerability you wanted to emulate, you could quickly spin up a 20 IP instance, run it for a few days and then spin it back down. Then you could release the data publicly without any worry about compromising your honeypot's anonymity.

I intend to follow up this post with a quick step by step guide on setting up a 20 IP Dionaea honeypot.

* I believe that strictly speaking the limit is 2 but I looked in to this once and it requires all sorts of faffing with things like load balancers which I deemed to not be worth the effort.