A financial services company runs a Lambda function attached to a private subnet that intermittently fails to reach an on-premises database over a Site-to-Site VPN. During failures, the CloudWatch metrics show no errors on the VPN tunnels, and the tunnels report UP. The network team suspects that Lambda is exhausting available Hyperplane ENIs or private IP addresses in the subnet during scaling events. Which action MOST directly confirms whether subnet IP address exhaustion is the root cause?