Reading Flow Log Records and Fields

A flow log record is a single line describing traffic for one connection during the aggregation interval. The default format is a fixed sequence of space-separated fields. Learning to read this line quickly is a core skill for any network investigation on AWS.

The heart of a record is the five-tuple: source address, destination address, source port, destination port, and protocol number. This uniquely identifies a conversation. Protocol 6 is TCP and 17 is UDP. Together these fields tell you exactly which endpoints were talking and over what service.

The srcaddr and dstaddr fields show the IP addresses involved. For traffic leaving an instance, srcaddr is the instance; for inbound, it is the remote peer. Reading direction correctly is essential: confusing source and destination can flip your entire understanding of an event.

The dstport usually tells you the service: 443 is HTTPS, 22 is SSH, 3389 is RDP, 3306 is MySQL. Unexpected destination ports, like outbound 6667 (IRC) often used by botnets, are red flags. The srcport is typically an ephemeral high-numbered port chosen by the client.

The bytes and packets fields count data transferred during the interval. A small request answered by a huge outbound byte count can indicate data exfiltration. Tracking these volumes over time helps distinguish normal chatter from a host suddenly shipping gigabytes to an unfamiliar address.

The action field is ACCEPT or REJECT. A REJECT means a security group or NACL blocked the flow. Many REJECTs from one source toward many ports suggest scanning. Crucially, security groups are stateful, so a REJECT there usually reflects a NACL rule, helping you locate which control acted.

The final field, log-status, is OK, NODATA, or SKIPDATA. NODATA means there was no traffic in the interval, and SKIPDATA means some records were skipped due to capacity. SKIPDATA is a warning that your visibility had a gap, which matters when you rely on completeness for an investigation.

Each record carries a start and end time in Unix epoch seconds for the aggregation window, not for each packet. When correlating Flow Logs with CloudTrail or application logs, remember the times mark the interval boundary, so an event may have occurred anywhere within that window.

A custom format can add high-value fields such as instance-id, vpc-id, subnet-id, tcp-flags, and flow-direction. The pkt-srcaddr and pkt-dstaddr fields reveal the original addresses behind NAT, which the basic srcaddr/dstaddr can mask. These extras dramatically speed up investigations.

To interpret a line, identify the five-tuple first, then the action and byte counts, then map the destination port to a service. Ask whether the direction, volume, and peer make sense for that instance's role. This disciplined read turns a cryptic log line into a clear statement of what happened.

With practice you spot anomalies instantly: SSH from an unknown internet IP, large outbound transfers to a new region, or repeated REJECTs scanning a subnet. The fields never change, so the skill is pattern recognition. This fluency is exactly what the exam tests in network-visibility scenarios.

Test your ability to read flow log records.

A flow log record centers on the five-tuple (src/dst address, src/dst port, protocol) plus bytes, packets, an ACCEPT/REJECT action, and a log-status of OK, NODATA, or SKIPDATA. Destination ports reveal services, byte counts hint at exfiltration, and custom formats add fields like instance-id and tcp-flags. Reading the tuple first builds fast investigative intuition.