How to Analyze AWS VPC Flow Logs
What’s in a VPC Flow Log record
Each record captures srcaddr, dstaddr, srcport, dstport, protocol, the action (ACCEPT or REJECT), and packet/byte counts, with the exact field set depending on which flow log version (v2 through v5) you’ve enabled. There’s no payload — just the metadata of who talked to whom, which is exactly the right granularity for network-layer reconnaissance and lateral movement detection.
What to look at first
REJECTconcentration by source IP. A normal client generates almost entirelyACCEPTed traffic. A scanner generates the inverse.- Destination port breadth from a single source. Many distinct
dstportvalues against onedstaddrin a short window is the core signature of port scanning. - Internal-to-internal traffic that crosses a trust boundary it shouldn’t. This is how you catch lateral movement after an initial single-host compromise — the scan pivots from external-facing to internal-facing.
- The handful of
ACCEPTed records mixed into aREJECT-heavy burst. Those are the open ports the scanner found, and the ones worth checking first. - NODATA/SKIPDATA records — these represent capacity constraints or AWS-internal traffic and should be filtered out before analysis, not treated as signal.
Common patterns and what they mean
| Pattern | Likely meaning |
|---|---|
| One source, many destination ports, mostly REJECT | Port scanning |
| Internal source scanning internal destinations | Lateral movement post-compromise |
| Sudden traffic to a new external IP from a sensitive instance | Possible C2 or exfiltration |
| ACCEPT on a port that shouldn’t be open | Security group misconfiguration found by the attacker first |
| High packet count, single long-lived connection | Possible data transfer, not just a scan |
Where manual log review breaks down
Flow logs are high-volume and low-context by nature — that’s the tradeoff for capturing everything. Spotting “this one IP touched 400 distinct ports in two minutes” among millions of otherwise-ordinary connection records is a pattern-matching problem, not a reading problem, and it doesn’t scale to manual review once you’re past a single small VPC.
LogTriage’s VPC Flow parser handles the dynamic header across flow log versions automatically, filters NODATA/SKIPDATA noise, and normalizes ACCEPT/REJECT into the same risk-scoring pipeline used for every other log format — so a scan shows up as a ranked finding, not a few hundred thousand individual lines.
Frequently Asked Questions
- What does a VPC Flow Log record, and what doesn't it record?
- Flow logs record connection metadata: source/destination IP and port, protocol, bytes, packets, start/end time, and accept/reject decision. They do not record packet payload, application-layer content, or DNS queries. For detecting port scans and connection-based reconnaissance, the metadata is sufficient.
- How do I enable VPC Flow Logs?
- From the AWS Console: VPC > Your VPCs > Select a VPC > Actions > Create flow log. Set the destination to CloudWatch Logs or S3, choose the filter (Accept, Reject, or All), and select a log format. For security monitoring, All traffic at v2 or v3 format gives a good signal-to-noise balance.
- What's the difference between flow logs at the VPC level versus the subnet or ENI level?
- VPC-level logs capture all traffic within the VPC. Subnet-level logs are scoped to one subnet. ENI-level logs are per network interface. For incident investigation, you can add temporary ENI-level logging for a specific compromised instance without incurring the full VPC logging cost.
- Does VPC Flow Log analysis require mapping private IP addresses to instance names?
- For deeper investigation, yes. Flow logs record private IPs, not instance names or resource tags. For a complete picture, you'd need to correlate flow log IPs with EC2 instance metadata or CloudTrail events that show which IP was assigned to which instance. LogTriage surfaces the raw IP data; the instance mapping requires cross-referencing your EC2 inventory.
Related Resources
See this detection run on a real report
Try the live demo with a pre-loaded malicious log set — no signup required — or upload your own log file and get a full AI-reviewed threat report in minutes.