How to scan outgoing VPC traffic to determine ports being called.

Question

Customer wants to baseline their network by understanding what outgoing ports are being called by systems within their VPC.

I know that you can turn on VPC flow logs, but that captures a lot of other information.  They could install an agent on EC2 and K8S but that is pretty time consuming.

Is there a simple way to get this information?

Accepted Answer

The choices boil down to:

1. Native VPC flow logs; VPC flow logs can now go directly to S3 ([link][1]). The use case (e.g. how frequently, fast, etc.) and preference will help determine the right query/visualization tool. CloudWatch Logs and Log Insights is a good solution, but S3 also opens the door to Athena, QuickSight, etc.

2. Agent-based logging via a roll-your-own or APN partner solution. Software on the individual EC2 instances reporting activity back to some sort of central reporting or data store.

3. Set up an EC2 instance (or instances) as a router / security appliance for packet inspection. Configure other EC2s to route their requests through this software appliance.

If they're looking for a simple way to get this info, I think #1 is the best bet. For example, consider dumping VPC Flow Logs to S3 and querying with Athena.... serverless solution, no EC2, K8, needed.

[1]: https://aws.amazon.com/about-aws/whats-new/2018/08/amazon-vpc-flow-logs-can-now-be-delivered-to-s3/

How to scan outgoing VPC traffic to determine ports being called.

Relevant content