Private Connectivity and Peering

The previous lesson moved content to the edge and completed the path of the request coming from outside. This whole path faces a single direction: toward a client arriving from the public network.

The fictional regional measurement network’s own components also send requests to each other. The collector network writes to the data warehouse, the dashboard calls a shared validation service sitting in another account. None of this traffic is client traffic — but today it flows through the same path as client traffic: with public addresses, over the public network, using the full surface of the gateway and the edge.

Two networks can connect to each other without ever going out to the public network. Peering connects two networks directly, private link opens only a single service through a single endpoint. This lesson compares all three on the same workload and asks the course’s question one last time.

• CN49. The fictional measurement network’s components sit in separate networks; the period’s flow volume is 2,400. The counterpart network has 96 instances, and each instance listens on four ports. Our own side has five route tables.
• CN50. The latency values are fictional model constants: 14 ms for the public endpoint, two for peering, three for private link. The model does not measure time, it writes the constants.
• CN51. The prices are fictional, the currency’s name is unit: public egress is two units per hundred volume, the inter-network private path is one unit, the private link endpoint’s period rent is 25 units. The central transit layer is a fixed 120 units a period plus 30 units per connection.
• CN52. Seven networks’ address blocks are fictional and all in private ranges; the address arithmetic is real. The 1,604-unit cost of re-addressing comes in as an input from this topic’s first lesson.
• CN53. Peering is not transitive: a peering only reaches its own two ends. The network to re-address is chosen greedily — the most-overlapping network moves first.

// connectivity/inter-network.mjs — model: the ways two networks connect to each other. Fictional
// regional measurement network; no real network is set up, the address arithmetic is real. The unit's name is "unit".
const PEER_INSTANCES = 96, PORTS = 4, TABLES = 5, VOLUME = 2400;
// [path, reachable items, latency(ms), unit per 100 volume, period-fixed,
//  routing lines, filter rule, external record]
const PATH = [
  ["public endpoint", 1, 14, 2.0, 0, 0, 2, 1],
  ["peering", PEER_INSTANCES * PORTS, 2, 1.0, 0, TABLES, 2, 0],
  ["private link", 1, 3, 1.0, 25, 0, 1, 0],
];
// [decision item, public endpoint, peering, private link]
const DECISION = [
  ["which range the route is written to", "you", "you", "provider"],
  ["which service on the other side is reachable", "other side", "you", "provider"],
  ["which direction traffic can originate from", "you", "you", "provider"],
  ["the exit address being registered on the other side", "you", "n/a", "n/a"],
  ["name resolution", "you", "you", "provider"],
  ["filter rules", "you", "you", "you"],
  ["address spaces not overlapping", "n/a", "you", "n/a"],
  ["the subnet the endpoint sits in", "n/a", "n/a", "you"],
];
const kept = (i) => DECISION.filter((k) => k[i + 1] === "you").length;
const handedOff = (i) => DECISION.filter((k) => ["provider", "other side"].includes(k[i + 1])).length;
const E = [18, 17, 13, 15, 13, 8, 13];
const print = (h) => h.map((d, i) => String(d)[i ? "padStart" : "padEnd"](E[i])).join("");
console.log(print(["path", "reachable items", "latency(ms)", "period unit", "rules+lines",
  "kept", "handed off"]));
PATH.forEach(([name, item, ms, rate, fixed, lines, filters, records], i) =>
  console.log(print([name, item, ms, ((VOLUME / 100) * rate + fixed).toFixed(1),
    lines + filters + records, kept(i), handedOff(i)])));

// --- Address space overlap: peering's item that cannot be taken back -------------
// Seven networks' blocks are fictional, all in private ranges; the address arithmetic is real.
const toInt = (ip) => ip.split(".").reduce((a, o) => a * 256 + Number(o), 0);
const block = (cidr) => { const [ip, e] = cidr.split("/"); const b = 2 ** (32 - Number(e));
  const start = Math.floor(toInt(ip) / b) * b; return { start, end: start + b - 1 }; };
const overlaps = (a, b) => a.start <= b.end && b.start <= a.end;
const NETWORK = [["measurement-collector", "10.42.0.0/20"], ["data-warehouse", "10.42.16.0/20"],
  ["shared-validation", "10.0.0.0/16"], ["field-unit", "10.0.0.0/16"],
  ["partner-a", "172.31.0.0/16"], ["partner-b", "172.31.0.0/16"],
  ["archive", "10.42.0.0/16"]].map(([name, c]) => ({ name, c, ...block(c) }));
const PAIR = NETWORK.flatMap((a, i) => NETWORK.slice(i + 1).map((b) => [a, b]));
const OVERLAPPING = PAIR.filter(([a, b]) => overlaps(a, b));
const RELOCATE = [];                                  // greedy: the most-overlapping network moves first
for (let remaining = [...OVERLAPPING]; remaining.length; ) {
  const counts = new Map();
  for (const [a, b] of remaining) for (const x of [a, b]) counts.set(x, (counts.get(x) ?? 0) + 1);
  const most = [...counts.entries()].sort((p, q) => q[1] - p[1] || NETWORK.indexOf(p[0]) - NETWORK.indexOf(q[0]))[0][0];
  RELOCATE.push(most);
  remaining = remaining.filter(([a, b]) => a !== most && b !== most);
}
const RELOCATE_COST = 1604;                           // input: from this topic's first lesson
const A = [24, 17, 19, 13, 20];
const print2 = (h) => h.map((d, i) => String(d)[i ? "padStart" : "padEnd"](A[i])).join("");
console.log("\n" + print2(["network", "block", "peerable networks", "overlapping", "re-addressed"]));
for (const a of NETWORK) {
  const c = NETWORK.filter((b) => b !== a && overlaps(a, b)).length;
  console.log(print2([a.name, a.c, NETWORK.length - 1 - c, c, RELOCATE.includes(a) ? "yes" : "no"]));
}
console.log(`\npairs ${PAIR.length}; peering ${PAIR.length - OVERLAPPING.length}/${PAIR.length}, ` +
  `private link ${PAIR.length}/${PAIR.length} (address space is invisible)`);
console.log(`networks to re-address: ${RELOCATE.length} (${RELOCATE.map((x) => x.name).join(", ")}) ` +
  `= ${RELOCATE.length * RELOCATE_COST} units`);

// --- No transitivity: peering count for N networks --------------------------------
// A peering only reaches its own two ends; the reached pairs equal the direct edge count.
const TRANSIT_FIXED = 120, TRANSIT_LINK = 30;         // fictional unit
const G = [10, 14, 15, 12, 17, 15, 16, 12];
const print3 = (h) => h.map((d, i) => String(d)[i ? "padStart" : "padEnd"](G[i])).join("");
console.log("\n" + print3(["networks", "pairs needed", "star reached", "full mesh", "full mesh lines",
  "transit links", "transit lines", "unit/pair"]));
for (const n of [3, 4, 6, 8, 12]) {
  const pairs = (n * (n - 1)) / 2, fee = TRANSIT_FIXED + TRANSIT_LINK * n;
  console.log(print3([n, pairs, n - 1, pairs, n * (n - 1) * TABLES, n, (TABLES + 1) * n,
    (fee / pairs).toFixed(1)]));
}

path                reachable items  latency(ms)    period unit  rules+lines    kept   handed off
public endpoint                   1           14           48.0            3       5            1
peering                         384            2           24.0            7       6            0
private link                      1            3           49.0            1       2            4

network                             block  peerable networks  overlapping        re-addressed
measurement-collector        10.42.0.0/20                  5            1                  no
data-warehouse              10.42.16.0/20                  5            1                  no
shared-validation             10.0.0.0/16                  5            1                 yes
field-unit                    10.0.0.0/16                  5            1                  no
partner-a                   172.31.0.0/16                  5            1                 yes
partner-b                   172.31.0.0/16                  5            1                  no
archive                      10.42.0.0/16                  4            2                 yes

pairs 21; peering 17/21, private link 21/21 (address space is invisible)
networks to re-address: 3 (archive, shared-validation, partner-a) = 4812 units

networks    pairs needed   star reached   full mesh  full mesh lines  transit links   transit lines   unit/pair
3                      3              2           3               30              3              18        70.0
4                      6              3           6               60              4              24        40.0
6                     15              5          15              150              6              36        20.0
8                     28              7          28              280              8              48        12.9
12                    66             11          66              660             12              72         7.3

The Bill for Three Paths

The first table’s second column is this lesson’s core measure: how many items become reachable once the connection is set up.

For the public endpoint this number is one — the single endpoint the other side publishes. For private link it is also one. For peering it is 384: 96 instances’ four ports each. Peering does not connect a service, it connects a network; which service is reachable is now the job of the filter rules, not the routing.

The bill column is unexpected. Peering is the cheapest — 24 units — because an inter-network fee is charged instead of the public egress fee. The public endpoint is 48 units. Private link is the most expensive at 49 units: its volume fee is the same as peering’s, plus the endpoint’s rent stacks on top. Read side by side, the three numbers show a pattern: the cheapest path is the path that opens the widest surface. The 25-unit gap between them is the price of closing off 383 items.

The rule count points the same way. Peering writes seven items: one line in each of the five tables, plus two filter rules. All five lines are the same line; writing four and skipping one silently drops one zone’s traffic onto a different path. Private link writes a single item.

The Decision Handed Off

The last two columns are this course’s own measure. For the public endpoint, five of eight decision items stay with the renter, one is the other side’s; no item is handed off to a provider. For peering, six items stay, zero are handed off. Peering does not hand off a single decision — which range the route is written to, traffic’s direction, name resolution, filters, and address spaces not overlapping are all the joint work of the two sides.

Private link is the reverse: two items stay, four sit with the provider. No route is written — the endpoint takes an address in one of your subnets, and the local route already covers it. Which service is reachable is not chosen; the endpoint is bound to a single service. Direction is not chosen either: the connection is one-way, the other side cannot connect back to you.

The two items that stay are the filter rules and which subnet the endpoint sits in. The second is this lesson’s small trap: the endpoint sits in a subnet, consumes one of its addresses, and the subnet boundary is a previous lesson’s item that cannot be taken back. The handoff is not a loss but a trade: four items went, and in exchange 383 reachable items and five routing lines went with them.

Address Space Overlap

The second table measures peering’s item that cannot be taken back, and it ties back to this course’s first lesson.

For two networks to be peerable, their address spaces must not overlap. If they do, the same address corresponds to two different machines, and no routing decision can be made. In the seven-network fictional plan there are 21 pairs, and four cannot be peered.

The reason reads right off the table. shared-validation and field-unit wrote the same block; so did partner-a and partner-b. These are not mistakes but a default: two separate teams left the same starting value in place, unaware of each other. The fourth overlap is different in kind: archive wrote its block one bit wider and swallowed two networks from its own organization inside it — on its own it costs two pairs.

The fix is not in routing. The peering is rejected, and no rule can force it through; the only thing that can be done is re-address one side. The model produces three networks to close four overlaps: 4,812 fictional units. Which side gets moved is a separate decision; moving a shared validation service is a different job from moving a field unit.

The last line gives the real comparison. Private link connects 21 of 21 pairs. The address spaces still overlap, but it no longer matters: the endpoint takes its own address in your subnet, and the counterpart network’s address space is never visible to you at all. This is the real thing received in exchange for the four-item handoff.

The Absence of Transitivity

The third table counts peering’s second limit. A peering only reaches its own two ends: if A is peered with B and B is peered with C, A and C cannot talk. The network in the middle is not a path.

The star column is the result. Connecting six networks to a central network needs five peerings and reaches five pairs — while what is needed is 15 pairs. Once the setup is done, every network is connected to something, and two thirds of the pairs cannot find each other.

A full mesh solves this, and it grows quadratically. Six networks need 15 peerings and 150 routing lines; twelve networks need 66 peerings and 660 lines. The line count is multiplied by five tables, because every network has its own tables.

A central transit layer makes the count linear: 12 connections for twelve networks, 72 lines, and the same 66 pairs. Its cost is in the last column, and it drops as scale grows: 70 units per pair at three networks, 7.3 units at twelve.

Summary

• Peering raises reachable items from one to 384 and is the cheapest path at 24 units; private link keeps items at one and is the most expensive at 49 units. The 25-unit gap between them is the price of closing off 383 items.
• Peering hands off no decision (six items stay, zero handed off); private link gives four items to the provider and leaves two — the filter rules and the subnet the endpoint sits in.
• In the seven-network plan, four of 21 pairs cannot be peered because of address overlap; the fix is re-addressing three networks, 4,812 fictional units. Private link connects 21 of 21 pairs in the same plan.
• Because peering is not transitive, the star layout reaches only five of six networks’ pairs; at twelve networks, a full mesh needs 660 routing lines while a central transit layer connects the same 66 pairs with 72 lines.

Course Wrap-Up

Lesson	Decision That Stays	Item That Cannot Be Taken Back	Surface Opened or Its Cost
Virtual Machine Instances	6/11 items, family and size	3 items: architecture, subnet, encryption	5.3 hours of fleet renewal
Machine Images	6/9 items, embedding level	3 items: published image, embedded secret	1,161 minutes of bake load
Persistent and Interruptible Capacity	5/9 items, job type match	3 items: unsaved work	2.40× duration
Launch Templates	5/8 items, field defaults	6 fields: image, subnet, script	11/12 fields overridden
Auto Scaling Groups	6/9 items, threshold and cooldown	3 items: unhealthy stamp	276 launches a day
Managed Container Services	3/15 items, task scaling	3 items: task definition version	234 hours of exit
Virtual Private Cloud	8/12 items, prefix length	2 items: block and placement	1,604 units to rebuild
Subnets	5 items, slice size and zone	1 item: subnet boundary	6 components, 5 tables
Route Tables	3 items, rule width	490 volume units, swallowed measurement	266 units of wrong egress
Internet and Address Translation Gateways	4 items, gateway count and placement	1,848 external log entries	101% connection fill
Security Groups and Network Access Lists	4 items, mechanism and order	double-recorded measurement	9 rules, 2 escaped flows
Load Balancers	9 items, layer and threshold	1 item: the balancer’s layer	7 termination points
Persistent Address and Name Integration	6 items, address layout	released address	4,875 requests to a stranger
Content Delivery Network	9/15 items, cache key	published response	3,600 seconds on the client
Private Connectivity and Peering	6 items under peering, 2 under private link	address space overlap	384 reachable items

The second column writes this course’s rule: even in a rented layer, a portion of the decisions stays with you; knowing which of them cannot be undone determines more than the rental decision itself. Even in the lesson with the highest handoff rate, three items stayed with the renter, and three items that cannot be undone stood alongside them.

The third column gathers into four clusters. Address space and its boundary in four lessons: the block itself, the subnet boundary, the subnet an instance lands on, and the overlap that blocks peering. A definition fixed at creation in four lessons: the published image, the startup script, the task definition version, the balancer’s layer. A trace that has escaped outward in three lessons: the gateway’s external log entries, the released address, the published response — all three living somewhere outside your control. Work lost or repeated in four lessons: the interrupted instance’s unsaved work, what the terminated instance was holding, the swallowed measurement, the double record.

None of the four clusters is a line on a bill. In none of the fifteen lessons did the item that cannot be undone produce a warning; every one of them was written silently on setup day, and its cost was measured periods later.

The machine was rented, scaled, and partly handed off; the network was split, routed, filtered, balanced, and moved to the edge. What runs on top of them, though — the data — still has not settled anywhere; measurement records and nightly digests passed through this course only as traffic. Storage and Data in the Cloud takes up that data and asks the same question: which decision is handed off when data is rented, and which item, once written, never changes again?