Working with ENI Flowlogs

Working with ENI Flowlogs

Setting up Flowlogs

1. Go to your network interface and create flow log (per this instruction)
2. It'll take about 5 min before you see anything in your Log Stream
3. Each entry will be in this format
   
• Protocols:
• 1: ICMP (source and dest ports will be 0)
• 6: TCP
• 17: UDP
•  Start/End are in UNIX Seconds

Basic search (from Cloudwatch Logs)

• Find all source IP of 10.0.0.1
  [a,b,c,d=10.0.0.1,e,f,g,h,i,j,k,l]
• Find all source IP of 10.0.0.1 destined to port 8443
  [a,b,c,d=10.0.0.1,e,f,port=8443,h,i,j,k,l]