Question

A network operations team runs a fleet of EC2 instances behind a custom TCP proxy on Nitro-based instance types. Applications intermittently report dropped connections during traffic spikes, but VPC Flow Logs show no REJECT entries and the instances' CPU and memory are healthy. The team suspects the instances are hitting Nitro network performance allowances (such as bandwidth or packet-per-second limits) that cause packets to be queued or dropped. Which approach provides the specific metrics needed to confirm this hypothesis?

Accepted Answer

Install the CloudWatch agent and collect the ethtool-based network performance metrics (bw_in_allowance_exceeded, bw_out_allowance_exceeded, pps_allowance_exceeded, conntrack_allowance_exceeded) exposed by the ENA driver

Answer

Enable VPC Flow Logs with the maximum aggregation interval and analyze the packets and bytes fields per flow in Athena

Answer

Enable Traffic Mirroring on the instances' ENIs and inspect the mirrored packets with a network analyzer appliance

Answer

Use Reachability Analyzer between the clients and the instances to verify there is no path-level packet drop