/google-cloud-networking-observability

VPC Flow Analysis Reference

Use VPC Flow Logs to analyze traffic patterns, volume, and latency.

🤖 Agent / Gemini CLI Instructions (MCP)

Agents should use Cloud Logging MCP for exploratory analysis or BigQuery MCP for high-volume trends. Fallback to the CLI if the MCP tools are not available.

• Exploratory Analysis: Typically involves looking at individual log entries or a small set of logs to understand specific events, debug issues, or investigate anomalies. This often requires filtering and examining the full details of log records.
• High-Volume Trends: Focuses on aggregating large datasets of logs over time to identify patterns, measure traffic volumes, analyze latency distributions, or find "top talkers." This usually involves SQL queries to summarize data rather than inspecting individual logs.

1. View Logs (Cloud Logging MCP)

Tool: list_log_entries

Filter: ALWAYS search for both VPC flow log sources:

(logName:"projects/{project_id}/logs/compute.googleapis.com%2Fvpc_flows" OR
logName:"projects/{project_id}/logs/networkmanagement.googleapis.com%2Fvpc_flows")
resource.type="gce_subnetwork"

2. Aggregate Trends (BigQuery MCP)

Tool: execute_sql

SQL Pattern:

SELECT timestamp,
JSON_VALUE(jsonPayload.connection.src_ip) AS src_ip,
JSON_VALUE(jsonPayload.connection.dest_ip) AS dest_ip,
CAST(JSON_VALUE(jsonPayload.bytes_sent) AS INT64) AS bytes_sent FROM
`{project_id}.{dataset_id}._AllLogs` WHERE log_name IN (
'projects/{project_id}/logs/compute.googleapis.com%2Fvpc_flows',
'projects/{project_id}/logs/networkmanagement.googleapis.com%2Fvpc_flows' ) AND
timestamp >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 1 HOUR) ORDER BY
timestamp DESC LIMIT 10

3. CLI Fallback

If MCP tools are unavailable, use the following gcloud and bq commands:

View Logs (gcloud)

gcloud logging read '(logName:"projects/{project_id}/logs/compute.googleapis.com%2Fvpc_flows" OR logName:"projects/{project_id}/logs/networkmanagement.googleapis.com%2Fvpc_flows") AND resource.type="gce_subnetwork"' --project {project_id} --limit 10 --format json --quiet

Aggregate Trends (bq)

bq query --use_legacy_sql=false --project_id {project_id} '
SELECT
  timestamp,
  JSON_VALUE(json_payload.connection.src_ip) AS src_ip,
  JSON_VALUE(json_payload.connection.dest_ip) AS dest_ip,
  CAST(JSON_VALUE(json_payload.bytes_sent) AS INT64) AS bytes_sent
FROM `{project_id}.{dataset_id}._AllLogs`
WHERE
  log_name IN (
    "projects/{project_id}/logs/compute.googleapis.com%2Fvpc_flows",
    "projects/{project_id}/logs/networkmanagement.googleapis.com%2Fvpc_flows"
  )
  AND timestamp >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 1 HOUR)
ORDER BY timestamp DESC
LIMIT 10
'

Flow Analyzer (Visual Analysis)

For visual traffic analysis and identifying "top talkers," use Flow Analyzer. It allows you to:

• Visualize traffic flows between regions, VPCs, and instances.
• Filter by source or destination dimensions.
• Identify high-bandwidth or high-latency connections.

Generic Guidelines

• Latency Aggregation: The primary field for RTT analysis in VPC Flow logs is json_payload.round_trip_time.median_msec. This field offers sub-millisecond precision and covers both TCP and Falcon traffic. Filter by reporter (SRC or DEST) to avoid double-counting traffic volume.

  For TCP-only traffic, you can also use json_payload.rtt_msec, which provides RTT in whole milliseconds. While less precise and with narrower coverage than round_trip_time.median_msec, it can be aggregated as follows:

  SELECT
    AVG(json_payload.rtt_msec) AS average_rtt_msec,
    MAX(json_payload.rtt_msec) AS max_rtt_msec
  FROM ...

Packet Drops Analysis

VPC Flow Logs record dropped packet volume, drop reasons, dropped packet/byte counters, and whether dropped traffic is included in sent throughput counters (when calculating packet loss rates, only add dropped packets to sent packets in the denominator when they are excluded from sent throughput).

• Firewall Deny Attribution: VPC Flow Logs report firewall drops without naming the specific rule. When identifying or ranking the responsible firewall rules, query Firewall Rules Logging (compute.googleapis.com/firewall).

Private Service Connect (PSC) Analysis

VPC Flow Logs also cover Private Service Connect (PSC) traffic across endpoints, service attachments, and PSC interfaces (PSC-I), capturing the reporting side (consumer or producer), endpoint/attachment details, connection IDs, and network attachments.

• Cross-Project Correlation: Producer-side flow logs include an annotation of the consumer's original pre-NAT 5-tuple (even though the producer workload does not see it directly), enabling correlation between consumer and producer logs using either the shared connection ID or the consumer connection annotation.

Serverless Workloads Analysis

VPC Flow Logs annotate serverless workloads using Direct VPC egress (such as Cloud Run and App Engine), capturing workload-specific metadata on source or destination.

• Dynamic IP Allocation: Serverless instances dynamically allocate IP addresses from the VPC subnet pool. Rather than filtering by static IP addresses, identify serverless traffic using the serverless workload metadata annotations.

Key Fields

• src_ip / dest_ip: Source and destination IP addresses.
• bytes_sent / packets_sent: Volume of traffic.
• round_trip_time.median_msec: The primary field for RTT analysis. This double field provides the median latency in milliseconds with sub-millisecond precision. It is populated for both TCP and Falcon traffic.
• rtt_msec: An int64 field representing Round-trip time in whole milliseconds. Populated only for TCP traffic. Generally, round_trip_time.median_msec is preferred due to higher precision and broader coverage.
• reporter: Usually src or dest indicating which side logged the flow.

Reference Documentation

• VPC Flow Logs record format