Packet Capture

Packet capture records packets observed at a network interface or another collection point, usually in a format such as PCAP or PCAPNG. Engineers analyze these records with tools such as Wireshark, tcpdump, or protocol-analysis platforms. Captures can reveal TCP connection establishment, retransmissions, resets, DNS exchanges, ICMP errors, and application messages when those messages are not encrypted. What a capture proves depends on where it was collected: seeing a packet leave a client does not prove that it reached the server.

Cloud environments typically do not allow customers to attach a sniffer to the provider's physical switches. Instead, engineers capture traffic inside a workload or use a supported traffic-mirroring capability to copy selected interface traffic to an analysis appliance. On AWS, VPC Traffic Mirroring copies selected traffic from supported EC2 network interfaces to a configured mirror target using VXLAN encapsulation. The collector must handle the encapsulation and have sufficient network, processing, and storage capacity. Mirroring does not automatically create a durable packet archive.

Flow logs and packet captures answer different questions. VPC Flow Logs provide flow-level metadata, such as addresses, ports, traffic counts, and accept or reject information, but do not record packet payloads or a packet-by-packet timeline. They are useful for broad, ongoing visibility across many resources. Packet capture provides deeper evidence for a narrower investigation, at greater collection and analysis cost. Neither method guarantees visibility into every packet or every managed-service internal path.

For a failed connection between an on-premises client and a cloud server, first identify the source, destination, protocol, port, expected route, and return route. Generate a controlled test using the actual application protocol, then capture at both endpoints where possible. Repeated TCP SYN packets at the client with no corresponding arrival at the server suggest a problem somewhere between those observation points. A SYN arriving at the server without a SYN-ACK leaving it shifts attention toward the server, its host firewall, or its local configuration. Compare captures with routing information, flow logs, and firewall logs before assigning a root cause.

Hybrid investigations must account for NAT, asymmetric routing, encryption boundaries, and packet size. NAT can change the addresses and ports used to correlate observations. A capture outside a VPN tunnel normally shows encrypted tunnel traffic rather than the original application packets. Successful small probes do not establish that larger application packets work; controlled packet-size tests and relevant ICMP messages can help diagnose path MTU problems. Synchronize capture-host clocks before comparing timestamps across environments.

Configuration-analysis tools complement captures but do not replace them. VPC Reachability Analyzer evaluates supported network configurations without sending packets. Transit Gateway Route Analyzer in AWS Network Manager analyzes transit gateway routing rather than capturing live traffic or proving application health. Across accounts, Regions, and VPCs, use these tools within their supported scopes, then validate actual behavior with controlled traffic and observations at accessible endpoints.

Capture collection has operational and security costs. Narrow the source interfaces, direction, protocols, time window, and captured packet length to the investigation. Truncation reduces volume but can remove evidence needed for protocol analysis. Collector overload can drop packets, while host offloading can produce misleading checksum or segmentation artifacts. TLS payloads remain encrypted unless an authorized decryption method is available. Treat capture files as sensitive data: restrict access, encrypt storage, define retention, and avoid collecting credentials or unrelated user content.