Core concept
Configure per VPC/subnet/ENI. Sampling not supported by default. Traffic Mirroring for packet-level capture.
Advertisement
How it works
Storage cost adds up. Aggregate to S3 + Athena for analysis. Or CloudWatch Insights for real-time.
Advertisement
Trade-offs + gotchas
Security investigation. Debugging connection failures. Compliance (auditable network log). ML anomaly detection.