VPC Flow Logs Secondary IP Address Capture
Short answer
A Create a new flow log that includes the pkt-dstaddr field to capture the original destination IP address of the traffic.
Question
Key Takeaways
The question tests the distinction between dstaddr (primary interface IP) and pkt-dstaddr (original packet destination), a common trap when managing multi-IP network interfaces.
When an EC2 instance has multiple secondary IPs, standard VPC flow logs only log traffic to the primary IP in the dstaddr field. To capture traffic destined for secondary IPs, you must enable the pkt-dstaddr field.
Common mistake: Choosing B (dstaddr) is incorrect because AWS documentation explicitly states that dstaddr will show the primary private IPv4 address even if traffic is sent to a secondary one, making it useless for this specific requirement.
Expert Analysis
Why the Answer Is Correct
According to AWS VPC Flow Logs documentation, when a network interface has multiple IPv4 addresses, the dstaddr field defaults to displaying the primary private IPv4 address. To accurately identify traffic sent to secondary private IPv4 addresses, the pkt-dstaddr field must be included in the flow log configuration. This field captures the original destination IP address of the packet before any NAT or interface translation occurs.
Why the Other Options Are Wrong
Option B (dstaddr) is incorrect because it specifically refers to the primary IP address of the network interface, failing to distinguish traffic for secondary IPs. Option C (pkt-srcaddr) captures the source IP, not the destination. Option D (srcaddr) captures the source IP of the interface, which is irrelevant for identifying the destination of incoming traffic to a secondary IP.
Community Comment Notes
Comments consistently cite the official AWS documentation regarding VPC Flow Logs limitations. The consensus highlights that while dstaddr shows the primary IP, pkt-dstaddr is required to see the actual destination IP for secondary addresses attached to the same ENI.
Official Reference
Array
This link opens the official vendor documentation in a new tab.
Exam Strategy
Memorize the specific fields for VPC Flow Logs, particularly pkt-srcaddr vs srcaddr and pkt-dstaddr vs dstaddr. Understand that 'pkt-' prefixed fields refer to the original packet headers, which is crucial for troubleshooting traffic involving NAT or secondary IPs.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
woorkim 👍 3 Answered Ahttps://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-limitations.html If your network interface has multiple IPv4 addresses and traffic is sent to a secondary private IPv4 address, the flow log displays the primary private IPv4 address in the dstaddr field. To capture the original destination IP address, create a flow log with the pkt-dstaddr field.
-
makanju 👍 1 Answered AAmazon VPC Flow Logs are used to capture network traffic information for interfaces in a VPC. By default, flow logs capture data for the primary private IP address of the network interface. However, to capture traffic for secondary IP addresses assigned to an interface, additional fields such as pkt-dstaddr are necessary.
-
exampb007 👍 1 Answered AA is the correct one
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →