After you’ve created a flow log, you can’t change its configuration or the flow log record format.You can’t enable flow logs for VPCs that are peered with your VPC unless the peer VPC is in your account.This includes EC2-Classic instances that have been linked to a VPC through ClassicLink. You can’t enable flow logs for the network interfaces that are in the EC2-Classic platform.

To use flow logs, you need to be aware of the following limitations:

The destinations to which you want to publish the flow log data.

The type of traffic to capture(accepted traffic, rejected traffic, or all traffic).

The resources for which to create the flow log.

If you create a flow log for a subnet or VPC, each network interface in that subnet or VPC is monitored.įlow log data for a monitored network interface is recorded as flow log records, which are log events consisting of fields that describe the traffic flow. You can create a flow log for a VPC, a subnet, or a network interface. You can create or delete flow logs without any risk of impact on network performance.

Determining the direction of the traffic to and from the network interfacesįlow log data is collected outside of the path of your network traffic, and therefore does not affect network throughput or latency.

Monitoring the traffic that is reaching your instance.

Diagnosing overly restrictive security group rules.

After you’ve created a flow log, you can retrieve and view its data in the chosen destination.įlow logs can help you with a number of tasks, such as: Flow log data can be published to Amazon CloudWatch Logs or Amazon S3. Message sent from the server to the client.VPC Flow Logs - is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. TCP flag value is 19, which indicates that there was SYN-ACK and a FIN The first line, the TCP flag value is 3, which indicates that there wasĪ SYN and a FIN message sent from the client to the server. The connection is established and finished within the same aggregation interval. Within a single aggregation interval, the flags might be set on the same line in theįlow log record for traffic flow in the same direction. To the server for the connection on port 43418. In the second aggregation interval, one of the connections that was establishedĭuring the previous flow is now closed. Network ACL permits inbound ICMP traffic but does not permit outbound ICMP traffic.īecause network ACLs are stateless, the response ping is dropped and does not reach Security groups are stateful, the response ping from your instance is allowed. Rules allow ICMP traffic but the outbound rules do not allow ICMP traffic.

(IP address is 203.0.113.12) to your instance (the network interface's Security groups are stateful - this means that responses to allowed trafficĪre also allowed, even if the rules in your security group do not permit it.Ĭonversely, network ACLs are stateless, therefore responses to allowed traffic areįor example, you use the ping command from your home computer Group rules or network ACL rules, be aware of the statefulness of these resources. If you're using flow logs to diagnose overly restrictive or permissive security

Vpc flow logs