1 Answer
- Newest
- Most votes
- Most comments
2
VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data is collected outside of the path of your network traffic, and therefore does not affect network throughput or latency.
Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of type interface. You can then send the traffic to out-of-band security and monitoring appliances for:
- Content inspection
- Threat monitoring
- Troubleshooting
So the logs are just that. Logs about your IP Traffic. Mirroring streams a copy of the network traffic say to an EC2 or Appliance for packet inspection
Relevant content
asked a year ago- asked 3 years ago
AWS OFFICIALUpdated 6 months ago- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 9 months ago
So for what I can see Traffic Mirroring allows you to monitor traffic not caputred by VPC flowlogs (from/to ENI to ENI or NLB) and further monitor it
Its actually 2 difference fundamental features. Logs just log the From/To IP address, Size of packet, port numbers etc.. The Mirror can have a full copy of the packet. Need to understand whats in a network packet vs information about the IP Header of the packet..