AWS packet investigation
From AWS finding to packet-grounded answer.
GuardDuty, CloudTrail, CloudWatch, and VPC Flow Logs help identify where and when to investigate. VPC Traffic Mirroring or a workload capture creates the packet record. PacketSafari explains what that record supports.
Vendor services provide signal, context, or packet acquisition. PacketSafari begins after an authorized packet capture exists.
Analysis result out
- Preliminary
- Verification
- Final Report
- SignalFind the entity and time window
- Packet acquisitionCreate or retrieve the PCAP
- PacketSafariTest the question against frames
Evidence depth
Each source answers a different question.
Context and flow metadata are valuable, but they are not raw packet contents. The clean handoff is to use them to scope a capture, then investigate the capture itself.
AWS CloudTrail
Who changed a resource, which API was called, and when the control-plane event occurred.
Amazon CloudWatch
Metrics and logs that reveal timing, saturation, errors, and service symptoms.
VPC Flow Logs
IP addresses, ports, protocol, byte and packet counts, actions, and time fields, not packet payloads.
Amazon GuardDuty
A managed finding that scopes the suspected behavior, entities, severity, and investigation window.
Traffic Mirroring / workload capture
Copied or host-captured traffic that can be stored as a bounded PCAP for packet-level investigation.
Operator workflow
From cloud symptom to reviewable packet proof.
The workflow is intentionally bounded. PacketSafari does not poll the cloud account or replace the continuous control plane.
Start with the AWS symptom.
Record the resource, ENI, peer, ports, finding time, service path, and the question the operator needs answered.
resource · entity · time windowCapture at the useful boundary.
Use VPC Traffic Mirroring where supported, capture on the workload, or retrieve traffic from an existing packet sensor.
authorized · filtered · bounded PCAPTest the cloud hypothesis.
PacketSafari maps the capture, follows the relevant flows, and separates preliminary direction from independent Verification.
frames · filters · flows · timingSend evidence to the owner.
Update the GuardDuty or SIEM case, change a control, repair the service, or escalate with explicit coverage and uncertainty.
reviewable report · next evidenceInvestigation outcomes
Ask the question the packet record can settle.
A useful result is not another generic alert. It is an answer attached to frames, filters, flows, timestamps, decoded fields, coverage, and uncertainty.
Did the suspected host actually beacon or move laterally?
Conversation timing, destinations, protocol behavior, repeated sequences, payload-visible indicators, and the exact supporting frames.
Was the AWS network path responsible for the slow transaction?
Handshake timing, loss and recovery, resets, receiver behavior, request-to-response gaps, and where observed delay accumulates.
Which team can act on the failure?
The service boundary, observed peer behavior, protocol state, capture limitations, and a defensible next diagnostic action.
Data boundary
Move the smallest useful packet window.
Choose the resource and time window first. Apply capture filters and retention policy at the acquisition point. Then use the SaaS, dedicated, or on-premises path authorized for that packet data.
Review deployment boundariesAWS + PacketSafari