Question

A network engineer is troubleshooting reports that a specific internal application running on an EC2 instance is returning corrupted HTTP responses to clients in another VPC connected via VPC peering. The engineer enables VPC Flow Logs in the default format on both instances' ENIs and confirms that traffic on TCP port 8080 is being ACCEPTED bidirectionally with no rejected records. Despite this, the payload corruption persists. Why can't VPC Flow Logs help further diagnose the root cause of the corrupted responses?

Accepted Answer

VPC Flow Logs capture only metadata about IP traffic and do not record packet payload contents, so application-layer corruption cannot be inspected.

Answer

VPC Flow Logs across VPC peering connections only record the accepting side, so the return traffic is never logged.

Answer

The default flow log format omits the TCP flags field, which is required to detect payload corruption.

Answer

VPC Flow Logs sample only 1 in every 10 packets, so corrupted packets are statistically likely to be missed.