- Newest
- Most votes
- Most comments
1.Why is an External Network Load Balancer IP (88.88.88.88) never found in any entries? Does only the Internal Network Load Balancer IP traffic appear (10.10.10.10)?
Ans: Yes, you are correct. You will get only private IP address of the network load balancer in the VPC flow logs. Public IP address is not logged in the VPC flow logs.
2.Note the timestamps are the same. Many VPC Flow logs show this same pattern. Is this the actual order?
Ans: The timestamp in the starting (2023-04-15T08:12:47.000 from sample log) is the time where the logs were delivered to the cloudwatch log group or s3 bucket based on the aggregation time interval. Actual packet timestamp is recorded as below: (from sample log : 1681546367 1681546374) start The time, in Unix seconds, when the first packet of the flow was received within the aggregation interval. This might be up to 60 seconds after the packet was transmitted or received on the network interface. end The time, in Unix seconds, when the last packet of the flow was received within the aggregation interval. This might be up to 60 seconds after the packet was transmitted or received on the network interface.
Reference documents: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-logs-fields
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-logs-aggregration-interval
Relevant content
- asked 2 years ago
- asked 2 years ago
- asked 2 years ago
AWS OFFICIALUpdated 2 years ago- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated 10 months ago
- AWS OFFICIALUpdated 5 months ago
Thank you Shivangi! To make sure I fully understand your reply.
I understand the timestamp is based on when the logs were delivered to the cloudwatch log group.
However in the sample, both the two events have the same exact packet timestamps of1681546367 1681546374. This is how the events appeared in Cloudwatch.
How do you tell which event came first? Did 10.10.10.10 communicate outbound to 99.99.99.99 first? Or did 99.99.99.99 communicate outbound to 10.10.10.10. first?
If multiple packets fall within the same aggregation internal, will their packet timestamps be the same? I think this is your explanation.
Thank you again
Hi again Shivangi,
Any thoughts on the above?
I am seeing this result often in my VPCFLOW logs where two events will both have the exact same packet timestamps, in this instance:1681546367 1681546374
How do we know which event came first? Is there an offset field or any additional fields in the log entries which show the order?