Mikulas · July 28, 2017 08:13
diff --git a/aws-vpc-flow-log-single-offender-source.sql b/aws-vpc-flow-log-single-offender-source.sql
 SELECT srcaddr, srcport, sum(bytes)
 FROM vpc
 WHERE crosszone=1
  AND external=0
  AND dstaddr='172.31.29.150'
 GROUP BY srcaddr, srcport
 ORDER BY 3 desc;
	SELECT srcaddr, srcport, sum(bytes)
	FROM vpc
	WHERE crosszone=1
	AND external=0
	AND dstaddr='172.31.29.150'
	GROUP BY srcaddr, srcport
	ORDER BY 3 desc;