flowlogs

Flowlogs are records produced by network devices or cloud platforms that describe the traffic that flows between endpoints over a period of time. A typical flowlog entry represents a unidirectional stream of packets and may include information such as start and end times, source and destination IP addresses and ports, protocol, the number of packets and bytes transmitted, the interface or network segment involved, and whether the traffic was allowed or denied. Some implementations also capture additional metadata such as the direction of traffic, subnet or VPC identifiers, and accounting details.

Flowlogs can originate from physical routers, switches, firewalls, and load balancers, as well as from cloud networking services in virtual private clouds. In cloud environments, flowlogs are often delivered to storage, log-analytics services, or security information and event management systems, and can be streamed in near real time or stored for later analysis. The exact schema and fields vary by platform, but the core idea is to provide a trace of who talked to whom, when, and how.

Uses of flowlogs include network monitoring, security analysis, incident response, compliance auditing, performance troubleshooting, and capacity planning. They support anomaly detection, verification of firewall and NAT configurations, mapping of application dependencies, and SLA validation. Processing typically involves normalization across sources, aggregation, and integration with SIEM or analytics pipelines.

Best practices involve enabling flowlogs for critical network segments, controlling data retention, applying thoughtful sampling, securing access to logs, and establishing alerting and dashboards to monitor unusual traffic patterns or denied connections. Common examples include cloud provider offerings that publish flow logs for virtual networks.