An application team reports intermittent east‑west TCP resets between VMs in the same subnet. You need to capture flow records showing whether traffic was accepted or dropped at the virtual network level. What should you enable?

Enabling VPC Flow Logs on the affected subnetwork is the correct solution because it directly provides the necessary flow records, including whether traffic was accepted or dropped, along with byte counts. This granular data is crucial for diagnosing intermittent TCP resets within a subnet, as it reveals network-level packet disposition. Enabling VPC Flow Logs at the VPC level would also capture the data, but specifying the subnetwork is more targeted and efficient for this particular issue. Packet Mirroring captures full packet data, which is overkill for simply determining accept/drop status and can be resource-intensive. Cloud Router (BGP) logging is irrelevant here as it pertains to routing table updates and BGP peer status, not individual VM-to-VM flow acceptance or drops within a subnet.