Amazon Virtual Private Cloud by Amazon Web Services
Author:Amazon Web Services
Language: eng
Format: mobi
Publisher: Amazon Web Services
Published: 2020-07-15T00:00:00+00:00
TCP flag sequence
The following is an example of a custom flow log that captures the following fields in the following order.
version vpc-id subnet-id instance-id interface-id account-id type srcaddr dstaddr srcport dstport pkt-srcaddr pkt-dstaddr protocol bytes packets start end action tcp-flags log-status
The tcp-flags field can help you identify the direction of the traffic, for example, which server initiated the connection. In the following records (starting at 7:47:55 PM and ending at 7:48:53 PM), two connections were started by a client to a server running on port 5001. Two SYN flags (2) were received by server from the client from different source ports on the client (43416 and 43418). For each SYN, a SYN-ACK was sent from the server to the client (18) on the corresponding port.
3 vpc-abcdefab012345678 subnet-aaaaaaaa012345678 i-01234567890123456 eni-1235b8ca123456789 123456789010 IPv4 52.213.180.42 10.0.0.62 43416 5001 52.213.180.42 10.0.0.62 6 568 8 1566848875 1566848933 ACCEPT 2 OK
3 vpc-abcdefab012345678 subnet-aaaaaaaa012345678 i-01234567890123456 eni-1235b8ca123456789 123456789010 IPv4 10.0.0.62 52.213.180.42 5001 43416 10.0.0.62 52.213.180.42 6 376 7 1566848875 1566848933 ACCEPT 18 OK
3 vpc-abcdefab012345678 subnet-aaaaaaaa012345678 i-01234567890123456 eni-1235b8ca123456789 123456789010 IPv4 52.213.180.42 10.0.0.62 43418 5001 52.213.180.42 10.0.0.62 6 100701 70 1566848875 1566848933 ACCEPT 2 OK
3 vpc-abcdefab012345678 subnet-aaaaaaaa012345678 i-01234567890123456 eni-1235b8ca123456789 123456789010 IPv4 10.0.0.62 52.213.180.42 5001 43418 10.0.0.62 52.213.180.42 6 632 12 1566848875 1566848933 ACCEPT 18 OK
In the second aggregation interval, one of the connections that was established during the previous flow is now closed. The client sent a FIN flag (1) to the server for the connection on port 43418. The server sent a FIN to the client on port 43418.
3 vpc-abcdefab012345678 subnet-aaaaaaaa012345678 i-01234567890123456 eni-1235b8ca123456789 123456789010 IPv4 10.0.0.62 52.213.180.42 5001 43418 10.0.0.62 52.213.180.42 6 63388 1219 1566848933 1566849113 ACCEPT 1 OK
3 vpc-abcdefab012345678 subnet-aaaaaaaa012345678 i-01234567890123456 eni-1235b8ca123456789 123456789010 IPv4 52.213.180.42 10.0.0.62 43418 5001 52.213.180.42 10.0.0.62 6 23294588 15774 1566848933 1566849113 ACCEPT 1 OK
For short connections (for example, a few seconds) that are opened and closed within a single aggregation interval, the flags might be set on the same line in the flow log record for traffic flow in the same direction. In the following example, the connection is established and finished within the same aggregation interval. In the first line, the TCP flag value is 3, which indicates that there was a SYN and a FIN message sent from the client to the server. In the second line, the TCP flag value is 19, which indicates that there was SYN-ACK and a FIN message sent from the server to the client.
3 vpc-abcdefab012345678 subnet-aaaaaaaa012345678 i-01234567890123456 eni-1235b8ca123456789 123456789010 IPv4 52.213.180.42 10.0.0.62 43638 5001 52.213.180.42 10.0.0.62 6 1260 17 1566933133 1566933193 ACCEPT 3 OK
3 vpc-abcdefab012345678 subnet-aaaaaaaa012345678 i-01234567890123456 eni-1235b8ca123456789 123456789010 IPv4 10.0.0.62 52.213.180.42 5001 43638 10.0.0.62 52.213.180.42 6 967 14 1566933133 1566933193 ACCEPT 19 OK
Download
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.
Web Development with Julia and Genie by Ivo Balbaert & Adrian Salceanu(6099)
State Management with React Query by Daniel Afonso(3407)
Eleventy by Example by Robinson Bryan;(3330)
Architecting Vue.js 3 Enterprise-Ready Web Applications by Solomon Eseme(3045)
Building Python Web APIs with FastAPI by Abdulazeez Abdulazeez Adeshina(2941)
Digital Marketing with Drupal by José Fernandes(2821)
Becoming an Enterprise Django Developer by Michael Dinder(1239)
Building Python Web APIs with FastAPI: A fast-paced guide to building high-performance, robust web APIs with very little boilerplate code by Abdulazeez Abdulazeez Adeshina(1178)
Operator Training Simulator Handbook by Joseph Philip(1145)
Practical WebAssembly: Explore the fundamentals of WebAssembly programming using Rust by Sendil Kumar Nellaiyapen(1074)
Google Workspace User Guide: A Practical Guide to Using Google Workspace Apps Efficiently While Integrating Them With Your Data by Balaji Iyer(1060)
State Management with React Query by Afonso Daniel;(1050)
Hands-on Cloud Analytics with Microsoft Azure Stack: Transform Your Data to Derive Powerful Insights Using Microsoft Azure by Prashila Naik(1039)
Building SPAs with Django and HTML Over the Wire: Learn to build real-time single page applications with Python by Andros Fenollosa(992)
Building Data Science Applications with FastAPI by François Voron(928)
Modern Frontend Development with Node.js by Florian Rappl(924)
High Performance with Laravel Octane by R. Butti(910)
Kubernetes Design Patterns and Extensions by Onur Yilmaz(900)
JavaScript from Frontend to Backend by Unknown(813)
