Flow Logs
Records of accepted and rejected network connections, giving a queryable history of what actually talked to what.
The single most useful network diagnostic, and it must be enabled in advance — flow logs are not retrospective.
What they answer that nothing else does: whether traffic reached the destination at all (distinguishing a network problem from an application one), which rule rejected it, what a service actually communicates with (the input to microsegmentation and egress allow-lists), where cross-zone and cross-region traffic is being generated for cost analysis, and — in a security investigation — whether data left and to where.
Their limits: they record connection metadata, not packet contents, so they show that a connection was accepted rather than what happened inside it. They are also sampled in some configurations, and they cost money in proportion to traffic, so retention should be deliberate.
For an application-layer problem where the connection succeeds, the next tool is tracing rather than packet capture.