Cloud Network ✓ fields verified against sample logs

AWS VPC Flow Log Format: Field Reference and Example Records

Published

One record per network flow through an elastic network interface in each aggregation window: which addresses talked on which ports, how much data moved, and whether security groups and network ACLs accepted or rejected it.

Official documentation: Flow log records (Amazon VPC User Guide)

Sample record

version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status
2 123456789012 eni-0a1b2c3d4e5f 203.0.113.10 10.0.1.50 54800 443 6 12 5400 1710468001 1710468061 ACCEPT OK
2 123456789012 eni-0a1b2c3d4e5f 203.0.113.10 10.0.1.50 54801 443 6 10 4200 1710468005 1710468065 ACCEPT OK

From the LogTriage parser test corpus — synthetic data, no real hosts or users.

Field reference

Field Type Meaning Why it matters for security
versione.g. 2 integer Flow log record version; 2 for the default format, 3–5 when custom formats add fields. Tells you which fields to expect and in what order.
account-ide.g. 123456789012 string AWS account that owns the network interface. Scopes the activity in multi-account organizations.
interface-ide.g. eni-0a1b2c3d4e5f string Elastic network interface the traffic was recorded on. Maps the flow to an instance, load balancer, NAT gateway or Lambda function.
srcaddre.g. 203.0.113.10 IPv4/IPv6 Source address of the flow as seen by the interface. External sources hitting many ports or hosts are scanners.
dstaddre.g. 10.0.1.50 IPv4/IPv6 Destination address of the flow. Internal destinations contacted from the internet show what is exposed.
srcporte.g. 54800 integer Source port. Ephemeral ports on the client side are normal; fixed low ports from a host can indicate a server responding.
dstporte.g. 443 integer Destination port. Many distinct dstport values from one srcaddr is a port scan; 22 and 3389 from the internet deserve attention.
protocole.g. 6 integer (IANA number) IP protocol number: 6 TCP, 17 UDP, 1 ICMP. Unexpected UDP volume can indicate tunnelling or amplification.
packetse.g. 12 integer Packets in the flow during the window. Very small counts across many ports are typical of scans.
bytese.g. 5400 integer Bytes in the flow during the window. Large outbound byte counts to rare external addresses are the basis of exfiltration detection.
starte.g. 1710468001 Unix time (seconds) When the first packet of the window was received. Convert from epoch seconds before correlating with other logs.
ende.g. 1710468061 Unix time (seconds) When the last packet of the window was received. Long-lived flows appear as many consecutive records.
actione.g. ACCEPT ACCEPT | REJECT Whether security groups and network ACLs allowed the traffic. REJECT bursts from one source are scanning; an ACCEPT to a sensitive port from the internet is an exposure.
log-statuse.g. OK OK | NODATA | SKIPDATA Whether the record has data: NODATA means no traffic in the window, SKIPDATA means records were skipped due to capacity or an internal error. SKIPDATA means the record is incomplete — do not treat silence as proof of no traffic.

What it records

A VPC flow log record summarizes the IP traffic through one elastic network interface during one aggregation window: source and destination address and port, protocol, packet and byte counts, the window’s start and end time, and whether the traffic was accepted or rejected by security groups and network ACLs. The default (version 2) format has the 14 fields shown in the sample above, space-separated, one record per line.

Flow logs cover traffic for EC2 instances, load balancers, NAT gateways, VPC endpoints and other services with network interfaces in the VPC. They do not record payloads, DNS queries to the Amazon-provided resolver, or traffic to the instance metadata service.

Where to get it

Enable a flow log on a VPC, subnet or individual network interface and choose a destination: CloudWatch Logs (good for queries over recent data), Amazon S3 (cheapest for long retention, optionally in Parquet), or Amazon Data Firehose for streaming into a SIEM. Choose ALL, ACCEPT or REJECT traffic; for security monitoring, capture ALL — rejected traffic is where scanning shows up, accepted traffic is where exfiltration does.

Parsing pitfalls

  • Custom formats change the field order. Versions 3–5 add fields such as vpc-id, subnet-id, tcp-flags, pkt-srcaddr and flow-direction, in the order chosen when the flow log was created. Read the header line (S3 delivery includes one) or the configured format rather than assuming positions.
  • Dashes are values. Records with log-status NODATA or SKIPDATA use - in place of addresses, ports and counts. Treat them as status records, not malformed lines.
  • Epoch seconds. start and end are Unix timestamps in seconds, not milliseconds — the classic off-by-1000 bug when joining with CloudTrail or application logs.
  • Addresses depend on the interface. On a NAT gateway or load balancer interface, srcaddr and dstaddr describe that hop, not the original client. pkt-srcaddr and pkt-dstaddr (custom formats) carry the packet-level addresses.
  • One connection, many records. A long-lived connection appears once per aggregation window; summing bytes across windows is needed for volume-based detection.

Detection ideas

  • Port scanning: one external srcaddr with REJECT records to many distinct dstport values within minutes — the basis of the VPC flow port-scanning rule.
  • Exposed management ports: ACCEPT from the internet to 22 (SSH) or 3389 (RDP).
  • Exfiltration: unusually high outbound bytes from one internal address to an external address it has not talked to before.
  • Command and control: small, regular flows from one host to the same external address and port at fixed intervals.
  • Lateral movement: an internal host suddenly connecting to many internal hosts on SMB (445) or RDP (3389).

Detections and guides for AWS VPC Flow Logs

Frequently Asked Questions

Do VPC Flow Logs capture packet contents?
No. They record metadata per flow — addresses, ports, protocol, packet and byte counts, timing and the accept or reject decision — but never payloads. For content you need traffic mirroring or host-level telemetry; flow logs tell you who talked to whom and how much.
What is the default aggregation interval?
Ten minutes, configurable down to one minute. All packets of a flow within the interval are summarized in one record, so a long connection produces a series of records and the start and end fields describe the window, not the whole connection.
Why can one connection show both ACCEPT and REJECT?
Each direction of a flow is recorded separately, and security groups (stateful) and network ACLs (stateless) are evaluated differently. If a network ACL allows the inbound request but blocks the response on ephemeral ports, the inbound record shows ACCEPT and the response record shows REJECT. Read both directions before deciding what actually got through.
How do I add fields like tcp-flags or vpc-id?
Create the flow log with a custom format and list the fields you want, which produces version 3 to 5 records. The field order in each line follows the format string you chose, so parsers must read the header or the configured format instead of assuming the default 14 fields.

Analyze AWS VPC Flow Logs logs

LogTriage auto-detects this format, enriches every IP, user agent and hash with threat intelligence, and writes an incident report mapped to MITRE ATT&CK.

Try Live Demo → Analyze Your Own Logs