CloudWrangler docs

Traffic Analysis

Overview

Traffic Analysis provides insights into your network traffic by analyzing VPC Flow Logs. See who's talking to whom, identify security issues, and understand bandwidth usage.

Requires VPC Flow Logs Setup to be completed first.

Features

Top Talkers

See the most active communication patterns:

  • Source → Destination: Which resources are communicating
  • Bandwidth: Total bytes transferred
  • Protocol: TCP, UDP, ICMP
  • Ports: Destination ports being accessed
  • Connections: Number of flow records

Top Talkers shows the last 24 hours of traffic, refreshed every 6 hours automatically.

Rejected Traffic

Identify blocked traffic (security issues):

  • Source/Destination IPs: Where rejected traffic originates
  • Ports: Which ports are being blocked
  • Reject Count: How many attempts were blocked
  • Protocol: Which protocols are rejected

Common causes:

  • Security group rules blocking traffic
  • Network ACL rules denying traffic
  • Misconfigured routing

Flow Diagram

Visual representation showing:

  • Resources as nodes (EC2, RDS, ALB, etc.)
  • Traffic flows as lines between nodes
  • Bandwidth as line thickness
  • Bidirectional traffic in purple
  • Click nodes to see details

Using Traffic Analysis

Loading Flow Logs

  1. Go to Traffic Analysis
  2. Select an AWS account
  3. Click Load Flow Logs (first time only)
  4. Wait ~30 seconds for analysis

Viewing Data

The page has three tabs:

  1. Top Talkers: Most active conversations
  2. Rejected Traffic: Blocked traffic attempts
  3. Flow Diagram: Visual network topology with traffic

Refreshing Data

  • Auto-refresh: Every 6 hours via background jobs
  • Manual: Click "Refresh" button
  • On-demand: Click "Load Flow Logs" to re-query Athena

Understanding the Data

Traffic Enrichment

CloudWrangler enriches flow logs with resource information:

IP Address → Resource Name

  • 10.0.1.45 → web-server-1 (i-abc123)
  • 10.0.2.89 → prod-database (db-xyz789)

This makes traffic analysis much easier than reading raw IPs.

Protocol Numbers

Common protocols:

  • 6 = TCP
  • 17 = UDP
  • 1 = ICMP

Action Types

  • ACCEPT = Traffic allowed
  • REJECT = Traffic blocked by security group or NACL

Use Cases

Security Monitoring

Identify security issues:

  • Unauthorized access attempts (rejected traffic)
  • Unexpected communication patterns
  • Port scanning attempts
  • Traffic to/from unknown IPs

Performance Troubleshooting

Diagnose performance issues:

  • Identify bandwidth-heavy resources
  • Find chatty database connections
  • Detect inefficient communication paths
  • Track cross-AZ traffic (costs money)

Capacity Planning

Understand usage patterns:

  • Peak traffic times
  • Growing bandwidth needs
  • Underutilized resources
  • Network bottlenecks

Cost Optimization

Reduce costs by:

  • Finding cross-region traffic (expensive)
  • Identifying NAT Gateway usage (per-GB charges)
  • Detecting unnecessary traffic
  • Optimizing VPC Endpoints usage

Best Practices

Follow these practices for effective traffic analysis:

  1. ✅ Enable Flow Logs: For all production VPCs
  2. ✅ Review Regularly: Check rejected traffic weekly
  3. ✅ Set Baselines: Understand normal traffic patterns
  4. ✅ Alert on Anomalies: Unusual patterns may indicate issues
  5. ✅ Document Findings: Track security incidents

Limitations

  • Delay: Flow logs have 5-10 minute delay
  • Sampling: High-traffic resources may be sampled
  • Retention: CloudWrangler stores last 24 hours by default
  • Costs: Athena queries cost $5/TB scanned (~$0.01/day typical)

Next Steps

Infrastructure Diagram

Visualize traffic flows

VPC Flow Logs Setup

Enable flow logs for your account

On this page