Traffic Analyzer is a cloud-native network analysis tool that analyzes VPC and TR flow logs to provide traffic visibility, performance monitoring, and troubleshooting for complex cloud networks.
With Traffic Analyzer, you can:
Optimize network performance: Apply data-driven insights for network architecture optimization and capacity planning across internet-facing, cross-region, and cross-VPC scenarios.
Troubleshoot network issues: Pinpoint the sources of traffic bursts to reduce troubleshooting time.
Enhance network security: Detect unexpected connections and potential threats by analyzing 5-tuple traffic details.
Optimize network costs: Identify top N traffic sources across multiple dimensions—city, internet service provider (ISP), IP address, protocol, and VPC—to support cost allocation and optimization.
Use cases
Traffic Analyzer gives you the visibility to answer the most common network questions fast: Who is generating the traffic? Which ports and services are involved? Is this normal behavior or an anomaly?
Use case 1: Fast troubleshooting in complex networks
Challenge: A sudden traffic burst saturates your internet bandwidth, Express Connect circuits, or NAT Gateway connections. Traditional troubleshooting is slow—it's hard to pinpoint which business unit, application, or IP address is causing the spike.
Solution: Traffic Analyzer analyzes traffic composition with minute-level precision, surfacing the top N traffic flows, IP addresses, and application ports. This gives you the data needed to apply rate limiting or plan capacity expansion.
Use case 2: Granular IT cost allocation across business lines
Challenge: Multiple departments or subsidiaries share network infrastructure. Fairly allocating costs based on each team's actual usage is a persistent challenge for IT financial management.
Solution: Multi-dimensional traffic statistics break down network consumption by application and traffic category, providing a reliable, auditable basis for internal cost allocation.
Use case 3: Network traffic compliance and security auditing
Challenge: Finance, government, and other regulated industries must strictly control and audit network traffic—detecting unauthorized or unexpected access before it leads to data leaks or security incidents.
Solution: Traffic Analyzer records and analyzes 5-tuple information for every network connection. Use this data to build traffic allowlists, identify abnormal access patterns, and strengthen compliance posture.
Advantages
Traffic Analyzer combines the convenience of a cloud-native architecture with powerful analytical capabilities.
-
Cloud-native and agentless deployment
Traffic Analyzer requires no agent installation on virtual machines or containers. Enable the flow log feature on relevant cloud products and add the logs as a data source—no changes to your workloads, no impact on performance or stability.
-
High performance and near real-time analysis
Powered by a leading big data streaming engine, Traffic Analyzer processes data with minute-level latency. When a network anomaly occurs, insights are available quickly, shortening the time to detect and resolve issues.
-
Unified analysis of multi-source logs
Traffic Analyzer provides unified analysis of VPC flow logs and TR flow logs from core network products. This covers hybrid cloud, intra-VPC, inter-VPC, and internet access scenarios in a single interface.
-
Rich data enrichment and contextual insights
Beyond 5-tuple analysis, Traffic Analyzer enriches raw data with geolocation (country, province, and city), ISP information, and resource topology. This turns raw log data into actionable business insights.
How it works
Traffic Analyzer collects, processes, enriches, and analyzes raw flow logs, then presents the results visually. The pipeline has four stages:
-
Log collection
Source products, not Traffic Analyzer, handle log collection. To perform traffic analysis, first add the collected flow logs to Traffic Analyzer as a data source. Traffic Analyzer supports VPC flow log and TR flow log data sources.
-
Data aggregation and enrichment
Within each sampling interval, the system aggregates multiple communications between two hosts that use the same protocol and port into a single record, then enriches these records with topology, geolocation, ISP data, and baseline context.
-
Analysis and storage
Enriched data is stored in a high-performance analytics engine that supports fast, flexible, multi-dimensional queries. The data retention period is configurable for historical analysis.
-
Visualization
The Traffic Analyzer console presents results through charts, maps, and topology diagrams, making it straightforward to view top N traffic rankings, network performance trends, and traffic distribution.
Supported regions
-
Regions that support connecting VPC flow log data to Traffic Analyzer
China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Guangzhou), China (Chengdu), China (Hong Kong), Japan (Tokyo), South Korea (Seoul), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), Thailand (Bangkok), Germany (Frankfurt), UK (London), US (Silicon Valley), and US (Virginia).
-
Regions that support connecting TR flow log data to Traffic Analyzer
China (Hangzhou), China (Shanghai), China (Shenzhen), China (Guangzhou), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Chengdu), Singapore, China (Hong Kong), Malaysia (Kuala Lumpur), Indonesia (Jakarta), Japan (Tokyo), South Korea (Seoul), Thailand (Bangkok), Germany (Frankfurt), UK (London), US (Virginia), and US (Silicon Valley).
Billing
Adding a data source to Traffic Analyzer incurs processing fees and storage fees. See Billing rules.