A company has replaced an old TCP-based application-layer protocol with a new TCP-based protocol that uses different ports. After migrating dozens of EC2 instances and containers over several months, the team wants to confirm no remaining systems still use the old port. The verification must cause no downtime. Which approach meets this requirement?

Capturing VPC Flow Logs and querying them with Amazon Athena is the most effective and non-disruptive method. Flow Logs record all IP traffic going to and from network interfaces, including source/destination IP, ports, and protocols. Athena can then efficiently query these logs stored in S3 to identify any traffic still using the old port, without impacting running applications. Amazon Inspector's Network Reachability rules primarily focus on network accessibility and security vulnerabilities, not active traffic patterns or specific port usage for application protocols. GuardDuty is a threat detection service; while it can detect anomalous port usage, it's not designed for comprehensive historical analysis of all traffic on a specific application port for inventory purposes. Manually inspecting security groups is time-consuming, prone to human error, and doesn't confirm active usage; removing ports could cause downtime if systems are still using them.