Question

A network engineer is investigating intermittent connection resets between application servers in a VPC and an external API. The default VPC Flow Log format only shows ACCEPT/REJECT actions and does not reveal enough detail about the TCP session lifecycle. The team needs to identify which packets carry SYN, SYN-ACK, and RST flags to determine whether resets originate from the client or the server, and they want to query this data efficiently at scale using SQL. What should the engineer do to enable this analysis with the least operational overhead?

Accepted Answer

Create a custom-format VPC Flow Log that includes the tcp-flags field, deliver logs to Amazon S3 in Parquet format, and query them with Amazon Athena.

Answer

Enable the default VPC Flow Log to CloudWatch Logs and use CloudWatch Logs Insights to parse the action field for RST packets.

Answer

Deploy packet mirroring with Traffic Mirroring on every ENI and forward all captured packets to a fleet of EC2 analysis appliances running Wireshark.

Answer

Use AWS Reachability Analyzer to trace the path between the application servers and the external API endpoint to identify where resets occur.