Oracle Cloud Infrastructure Documentation

VCN Flow

The VCN Flow dashboard helps you monitor network traffic and investigate connectivity and security concerns using OCI VCN Flow Logs.

The Overview tab summarizes recorded activity, accepted and rejected traffic, and capture status. Traffic Analysis examines sources, destinations, ports, protocols, and subnet activity. Security Analysis highlights potential scanning activity, large transfers to public destinations, and accepted traffic to sensitive ports for further investigation.

Prerequisites and Usage Notes:

  • Ingest VCN flow logs using the OCI VCN Flow Unified Schema Logs source.

  • Select a time range and use compartment and entity filters to narrow the analysis. Results reflect only the collected logs within those selections.

  • Traffic records summarize a flow in one direction at a network interface during a capture window; other records report capture status. Record counts represent log entries rather than packets or unique connections.

  • Security widgets provide investigation leads rather than confirmed security findings. Open a widget in Log Explorer to examine its results and related records.

  • Use a time range of up to seven days. Longer ranges can return partial results or fail when the log volume is very high.

Here's the list of widgets displayed in the Overview tab in the VCN Flow dashboard:

Widget Description
Total Flow Logs Shows the total number of VCN flow log records, a trend line, and the percentage change from the preceding period of the same length. Use it to identify changes in logging volume; counts include traffic and capture-status records, rather than individual packets or connections.
Total Bytes Out Shows the total recorded bytes, a trend line, and a comparison with the preceding period. The total includes internal, inbound, and outbound traffic, and traffic logged at both interfaces can be counted twice.
Reject Rate % Shows rejected records as a percentage of accepted and rejected records, with a trend line and a comparison with the preceding period. Use it to investigate changes in traffic blocked by security lists or network security groups.
Observed Subnets Shows the number of distinct subnets represented in the flow logs. This count reflects observed logging activity rather than the total number of subnets in the tenancy.
Traffic by Action Shows the distribution of accepted and rejected flow log records. Use it to compare the volume and proportion of traffic records allowed or blocked by network security rules.
Status Distribution Shows the distribution of flow log capture statuses: OK for normal traffic records, NODATA when no traffic was recorded during the capture window, and SKIPDATA when records were skipped because of system errors or capacity issues. Use it to identify reported capture gaps; percentages represent shares of log records rather than the percentage of traffic successfully captured.
Public IP Locations Shows the approximate locations of public source or destination IP addresses, with bubble sizes representing log-record counts. Use it to identify geographic concentrations or unexpected locations for investigation; records without location information are excluded.
Flow Volume by Action over Time Shows accepted and rejected flow log-record counts over time. Use it to identify spikes, drops, or sustained changes in allowed and blocked traffic.

Here's the list of widgets displayed in the Traffic Analysis tab in the VCN Flow dashboard:

Widget Description
Network Throughput Trend Shows recorded bytes and packets over time, using the left and right axes respectively. Use it to identify bursts or unexpected drops, accounting for the aggregation interval because each point represents an interval total rather than a rate.
Top Source Ports Shows up to five source port numbers with the most TCP and UDP flow log records, combining both protocols for each port number. Use it to identify frequently observed source ports; percentages represent shares of the displayed records.
Top Destination Ports Shows up to five destination port numbers with the most TCP and UDP flow log records, combining both protocols for each port number. Use it to identify frequently targeted ports; percentages represent shares of the displayed records, and port numbers alone do not confirm the application involved.
Top Protocols Shows the most frequently recorded network protocols, such as TCP, UDP, and ICMP, by log-record count. Use it to compare the protocol mix; percentages represent shares of the displayed records rather than bytes or packets.
Top Source IPs by Bytes Out Shows up to five source IP addresses with the highest total recorded bytes. Use it to identify sources contributing the most traffic, including sources inside and outside your network.
Top Destination IPs by Bytes Out Shows up to five destination IP addresses with the highest total recorded bytes. Use it to identify destinations receiving the most traffic, including internal and external destinations rather than internet traffic alone.
Top Destination Ports by Action Shows up to five destination port numbers with the most TCP and UDP flow log records, split into accepted and rejected counts. Use it to identify ports with substantial blocked traffic, then investigate the associated sources, destinations, and protocols.
Top Protocols by Action Shows the most frequently recorded network protocols, split into accepted and rejected log-record counts. Use it to compare which protocols account for the most allowed and blocked traffic.
Top Rejected Source IPs Shows up to five source IP addresses with the most rejected flow log records. Use it to prioritize sources for investigation; a high rejection count alone does not establish malicious activity.
Top Rejected Destination Ports Shows up to five destination ports with the most rejected flow log records. Use it to identify ports receiving substantial blocked traffic and investigate whether the activity is expected.
VCN / Subnet Activity Shows up to five subnets with the most flow log records, including accepted and rejected counts, rejection percentages, recorded bytes, and associated VCN and subnet OCIDs. Use it to compare subnet activity and identify where blocked traffic is concentrated.

Here's the list of widgets displayed in the Security Analysis tab in the VCN Flow dashboard:

Widget Description
Rejected Traffic Snapshot Shows rejected log-record counts and distinct source IP, destination IP, and destination port counts. Use it as a starting point for investigating blocked traffic; destination port counts cover TCP and UDP only, while the other totals include all rejected protocols.
Vertical Port Sweep Suspects Highlights sources contacting at least 20 distinct destination ports on one host, grouped by VCN and protocol, using rejected TCP/UDP traffic and accepted traffic from public sources while excluding likely replies. Use it to investigate possible port scans; accepted internal traffic is excluded, and the recommended time range is up to seven days.
Horizontal Host Sweep Suspects Highlights sources contacting at least three destination hosts on a critical port or at least ten hosts on another monitored port, grouped by VCN and protocol, using rejected TCP/UDP traffic, accepted traffic from public sources, and accepted internal traffic on administration and database ports while excluding likely replies. Use it to investigate possible host scans; critical ports appear first, and the recommended time range is up to seven days.
Public Egress Top Talkers Compares recorded bytes and flow-record counts for accepted traffic to public destination IP addresses, grouped by source IP, destination IP, and destination port. Use it to investigate large or unusual transfers; records without a public destination classification are excluded, and a public destination does not necessarily imply internet transit.
Accepted External Sensitive-Port Hits Shows approximate source locations and log-record counts for accepted traffic from public IP addresses to selected sensitive destination ports. Use it to review potentially unexpected access; records without public IP classification or location information are excluded, and acceptance does not establish a successful application connection or login.