Question

A network engineer is troubleshooting intermittent connection resets reported by an application running on a single EC2 instance in a large subnet that hosts hundreds of other instances. The engineer needs to capture accepted and rejected traffic specifically for that one instance's primary network interface with the least operational overhead and minimal extra log volume. Which approach should the engineer use?

Accepted Answer

Enable a VPC Flow Log at the network interface (ENI) level for the instance's primary ENI, filtering for ALL traffic.

Answer

Enable a VPC Flow Log at the subnet level filtering for ALL traffic and query the results with Athena to isolate the instance.

Answer

Enable a VPC Flow Log at the VPC level filtering for REJECT traffic and use CloudWatch Logs Insights to filter by the instance IP.

Answer

Install the CloudWatch agent on the instance to stream OS-level packet capture data to CloudWatch Logs.