Network Observability & Flow Analysis

NetFlow/sFlow/IPFIX, VPC flow logs, Hubble, Prometheus network metrics, East-West traffic visibility, and anomaly detection.

Overview

Overview Network observability provides visibility into what traffic is flowing where — without full packet capture. Modern network observability stacks use flow records, metrics, and structured logs rather than raw PCAP.

Flow record protocols: - NetFlow v9 / IPFIX (RFC 7011): Cisco-originated, now standardized. Network devices export flow records (5-tuple + byte/packet counts + timestamps) to a collector. IPFIX is the IETF standardization of NetFlow v9. - sFlow: samples 1-in-N packets rather than tracking all flows. Lower overhead, suitable for high-speed links. Less accurate for small flows. - VPC Flow Logs (AWS/GCP/Azure): cloud-managed flow logging. AWS VPC Flow Logs write to CloudWatch Logs or S3. Fields: srcaddr, dstaddr, srcport, dstport, protocol, packets, bytes, action (ACCEPT/REJECT). Enable per-ENI, per-subnet, or per-VPC. Critical for security incident investigation.

Kubernetes-native observability: - Hubble (Cilium): exports L3/L4/L7 flow records from eBPF ring buffers. DNS queries, HTTP method/path/status, TCP RSTs, drop reasons — all without sidecar overhead. Queried via hubble observe CLI or Hubble UI. - Prometheus + kube-state-metrics + node-exporter: metrics-based. Track interface bytes/packets/errors, TCP socket states (ss -s), conntrack table utilization.

Distributed tracing: correlates network calls with application spans. Jaeger/Tempo track latency across microservice calls. Istio injects trace headers (X-B3-TraceId) automatically.

Anomaly detection patterns: baseline normal traffic profiles (bytes/s per service pair, connection counts, error rates). Alert on: sudden bandwidth spikes, new service-to-service connections, abnormal port usage, high TCP RST rates, or REJECT spikes in VPC flow logs.

Key concepts

IPFIX
IP Flow Information Export (RFC 7011). IETF standardization of NetFlow v9. Network devices export flow records (5-tuple, bytes, packets, timestamps) to a collector. The standard format for NetFlow-compatible systems.
VPC Flow Logs
Cloud-managed flow record service. AWS logs per-ENI flows to CloudWatch/S3 with ACCEPT/REJECT action. GCP logs per-VM flows with project/region metadata. Essential for security investigations and compliance.
Hubble
Cilium's network observability layer. Reads eBPF ring buffer data to export per-flow L3/L4/L7 records — DNS, HTTP, TCP drops — without sidecars. Accessible via hubble observe CLI.
East-West traffic
Traffic between services within the same data center or cluster. Often invisible to traditional network monitoring (which focuses on North-South ingress/egress). Service mesh and CNI observability cover East-West.
sFlow
Statistical sampling of 1-in-N packets. Lower overhead than NetFlow for high-throughput links. Less accurate for bursty small flows. Common in data center switching fabrics.

When to use it

  • Investigating a security incident — which external IPs communicated with a compromised host?
  • Capacity planning — which service pairs generate the most East-West traffic?
  • Debugging Kubernetes DNS failures — is the query reaching CoreDNS?
  • Detecting lateral movement in a compromised cluster via abnormal connection patterns

Interview questions

  • How do you use VPC Flow Logs to investigate a security incident?
  • How does Hubble provide L7 network visibility without sidecar proxies?

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio