VPC flow logs difference with VPC traffic mirroring

0

I would like to undertand when to use VPC flow los and when to us VPC traffic mirroring.

What is the main difference?

Is VPC traffic mirroring an enhanced feature of VPC flow logs to get more detailed information?

asked a year ago1208 views
1 Answer
3
Accepted Answer

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data is collected outside of the path of your network traffic, and therefore does not affect network throughput or latency.

Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of type interface. You can then send the traffic to out-of-band security and monitoring appliances for:

  • Content inspection
  • Threat monitoring
  • Troubleshooting

So the logs are just that. Logs about your IP Traffic. Mirroring streams a copy of the network traffic say to an EC2 or Appliance for packet inspection

profile picture
EXPERT
answered a year ago
profile picture
EXPERT
reviewed a month ago
profile picture
EXPERT
reviewed a year ago
profile pictureAWS
EXPERT
reviewed a year ago
profile picture
EXPERT
reviewed a year ago
  • So for what I can see Traffic Mirroring allows you to monitor traffic not caputred by VPC flowlogs (from/to ENI to ENI or NLB) and further monitor it

  • Its actually 2 difference fundamental features. Logs just log the From/To IP address, Size of packet, port numbers etc.. The Mirror can have a full copy of the packet. Need to understand whats in a network packet vs information about the IP Header of the packet..

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions