Article 17 – OCI Network Observability: VCN Flow Logs, Network Visualizer, and Route Analyzer

1. Introduction to OCI Network Observability

Operating enterprise cloud infrastructure requires continuous visibility into network traffic patterns, performance bottlenecks, security policy evaluation, and routing topologies. Without robust observability tools, diagnosing dropped packets, investigating security breaches, or auditing compliance boundaries becomes a guessing game.

Oracle Cloud Infrastructure (OCI) delivers an end-to-end network observability suite anchored by 4 key capabilities:
1. VCN Flow Logs: Detailed audit records of IP traffic passing through VNICs.
2. Network Visualizer: Graphical topology map of VCNs, subnets, gateways, and routing attachments.
3. VCN Route Analyzer: Hop-by-hop virtual network path tracer.
4. Service Connector Hub: Log streaming pipeline to SIEMs (Splunk, Microsoft Sentinel) and Object Storage.

2. VCN Flow Logs Architecture & JSON Schema

VCN Flow Logs record metadata about IPv4 and IPv6 packets traversing VNICs attached to compute instances, load balancers, database nodes, and virtual firewalls.

Flow logs capture traffic at the SmartNIC level, ensuring zero performance overhead on guest operating systems.

VCN Flow Log JSON Payload Example:

{
  "datacontenttype": "application/json",
  "data": {
    "action": "REJECT",
    "destinationAddress": "10.0.2.50",
    "destinationPort": 1521,
    "protocol": 6,
    "protocolName": "TCP",
    "sourceAddress": "198.51.100.45",
    "sourcePort": 49152,
    "vnicId": "ocid1.vnic.oc1.iad.samplevnic123",
    "bytesIngress": 64,
    "packetsIngress": 1,
    "status": "OK"
  },
  "eventTime": "2026-09-17T05:30:00.000Z",
  "source": "com.oraclecloud.vnic.flowlog"
}

Key Fields:

• action: ACCEPT (Permitted by Security List/NSG) or REJECT (Dropped by firewall rule).
• protocol: IP protocol number (6 = TCP, 17 = UDP, 1 = ICMP).
• bytesIngress / packetsIngress: Volume metrics for network traffic profiling.

3. Network Command Center Diagnostic Tools

1. Network Visualizer

A real-time interactive diagramming tool in the Console that auto-discovers and renders VCN layout topologies, subnets, route tables, LPG/DRG attachments, security boundaries, and attached resources across compartments.

2. VCN Route Analyzer

Performs hop-by-hop virtual path simulation between any two endpoints (e.g., Compute VM A $\rightarrow$ On-Premises IP).
* Simulates packet traversal through VCN Route Tables, DRG Route Tables, LPGs, Security Lists, and NSGs.
* Pinpoints exact failure points (e.g., “Packet dropped at Step 3: Security List SL-App-Private lacks Ingress rule for port 443”).

Path Simulation Result:
[Source: 10.0.1.15] ──> [Route Table Check: PASSED] ──> [DRG Attachment: PASSED] ──> [NSG Check: FAILED ❌]

4. OCI Web Console (GUI) Step-by-Step Walkthrough

Follow these operational steps to enable VCN Flow Logs on a Private Subnet and stream them to Object Storage via Service Connector Hub.

Step 1: Enabling VCN Flow Logs

1. Open Navigation Menu (≡) ➔ Observability & Management ➔ Logging ➔ Logs.
2. Click Enable Resource Log.
3. Configure settings:
4. Resource Compartment: Network-Compartment
5. Service: Select Virtual Cloud Network (VCN).
6. Resource: Select Subnet-Private-Regional.
7. Log Category: Select Flow Logs.
8. Log Name: FlowLogs-Subnet-Private
9. Log Group: Select LogGroup-Network-Security.
10. Click Enable Log.

Console Path: [≡ Main Menu] ➔ [Observability & Management] ➔ [Logging] ➔ [Logs]

Step 2: Running a Route Analyzer Diagnostic Path Test

1. Navigate to Networking ➔ Network Command Center ➔ Route Analyzer.
2. Click Run Analysis:
3. Source Type: Select Compute Instance (VM-App-01).
4. Destination Type: Select IP Address (192.168.10.50 – On-Premises DB).
5. Click Run Analysis.
6. Review the hop-by-hop visual trace. If a route rule or NSG blocks traffic, Route Analyzer highlights the specific missing rule in red.

Step 3: Exporting Logs via Service Connector Hub

1. Navigate to Observability & Management ➔ Logging ➔ Service Connectors.
2. Click Create Service Connector:
3. Name: Connector-FlowLogs-To-Storage
4. Source: Select Logging.
5. Target: Select Object Storage.
6. Under Configure Source:
7. Log Group: LogGroup-Network-Security | Log: FlowLogs-Subnet-Private.
8. Under Configure Target:
9. Bucket: Select bucket-network-audit-logs.
10. Click Create. Flow logs are streamed to compressed JSON files in Object Storage automatically.

5. Common Architectural Misconceptions & Pitfalls

Misconception 1: “Enabling VCN Flow Logs Degrades Compute VM Network Throughput”

• Reality: VCN Flow Logs are generated asynchronously at the SmartNIC off-box hardware layer. Capturing flow logs introduces zero CPU overhead, zero latency penalty, and zero throughput degradation on running compute instances.

Misconception 2: “Route Analyzer Modifies Live Route Tables During Testing”

• Reality: VCN Route Analyzer is a pure control-plane simulation tool. It reads current route table and security rule configurations to trace hypothetical packet paths without sending actual network packets or modifying live configurations.

6. OCI Network Observability vs. Other Cloud Platforms