VPC flow logs difference with VPC traffic mirroring

0

I would like to undertand when to use VPC flow los and when to us VPC traffic mirroring.

What is the main difference?

Is VPC traffic mirroring an enhanced feature of VPC flow logs to get more detailed information?

preguntada hace un año1140 visualizaciones
1 Respuesta
3
Respuesta aceptada

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data is collected outside of the path of your network traffic, and therefore does not affect network throughput or latency.

Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of type interface. You can then send the traffic to out-of-band security and monitoring appliances for:

  • Content inspection
  • Threat monitoring
  • Troubleshooting

So the logs are just that. Logs about your IP Traffic. Mirroring streams a copy of the network traffic say to an EC2 or Appliance for packet inspection

profile picture
EXPERTO
respondido hace un año
profile picture
EXPERTO
revisado hace 10 días
profile picture
EXPERTO
revisado hace un año
profile pictureAWS
EXPERTO
revisado hace un año
profile picture
EXPERTO
revisado hace un año
  • So for what I can see Traffic Mirroring allows you to monitor traffic not caputred by VPC flowlogs (from/to ENI to ENI or NLB) and further monitor it

  • Its actually 2 difference fundamental features. Logs just log the From/To IP address, Size of packet, port numbers etc.. The Mirror can have a full copy of the packet. Need to understand whats in a network packet vs information about the IP Header of the packet..

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas