Is there a way to mirror traffic without VPC Traffic Mirroring (AWS Free Tier)?

Hello.

If VPC traffic mirroring is not available, you can check the traffic by capturing packets using tcpdump or similar on the EC2 OS side.
https://repost.aws/knowledge-center/network-issue-vpc-onprem-ig

There are a few options you can consider to capture network traffic between EC2 instances in the AWS free tier without using the VPC traffic mirroring service:

1. Use tcpdump on the EC2 instances: You can install and run tcpdump on both EC2 instances to capture the network traffic. On the instance you want to monitor, run the following command to capture all traffic:

   sudo tcpdump -i eth0 -w capture.pcap
   

   This will save the captured traffic to a file named capture.pcap. You can then copy this file to the other instance or a local machine for analysis.

2. Use Amazon CloudWatch Logs: You can enable VPC flow logs on your EC2 instances, which will send network traffic data to CloudWatch Logs. This data can then be analyzed using CloudWatch Logs or exported to an external tool. To enable VPC flow logs, follow these steps:

   • Go to the VPC console in the AWS Management Console.
   • Select the VPC containing the EC2 instances.
   • Go to the "Flow Logs" section and create a new flow log.
   • Choose the appropriate subnet or network interface to monitor, and select CloudWatch Logs as the destination.

   Once the flow log is enabled, you can access the captured network data in CloudWatch Logs.

3. Use a network sniffer on a local machine: If you have a local machine (e.g., your own computer) that can access the EC2 instances, you can use a network sniffer tool like Wireshark to capture the traffic. To do this, you'll need to set up a VPN or SSH tunnel between your local machine and the EC2 instances to be able to see the network traffic.

   • Install Wireshark on your local machine.
   • Create an SSH tunnel or VPN connection to one of the EC2 instances.
   • In Wireshark, select the appropriate network interface (the one connected to the SSH tunnel or VPN) and start capturing the traffic.

Keep in mind that the first two options (tcpdump and CloudWatch Logs) will capture the traffic directly on the EC2 instances, while the third option (using a local network sniffer) will require you to set up a secure connection between your local machine and the EC2 instances.