A network engineer must list the IP addresses that are sending traffic to an EC2 instance. VPC Flow Logs are enabled. The instance has one network interface with two IP addresses, but the flow logs only show traffic for the primary address. How can the engineer find flow log records for traffic destined to the secondary IP address?

The pkt-dstaddr field in VPC Flow Logs records the original destination IP address of the packet before any NAT translation. This is crucial when an EC2 instance has multiple IP addresses, such as a primary private IP and a secondary private IP, or when an Elastic IP is associated. The default flow log format only includes dstaddr, which shows the post-NAT destination IP. To see traffic destined for the secondary IP address, you need to explicitly include pkt-dstaddr in a custom flow log format. dstaddr would only show the primary IP after NAT. pkt-srcaddr and srcaddr relate to the source IP address, not the destination.