A security team needs full packet capture of traffic to a group of IaaS workloads to investigate suspected command-and-control activity. They cannot attach a physical network tap because the provider owns the switches. What is the most appropriate approach?

Packet capture in cloud environments must use virtualized mechanisms because customers have no physical access to the provider's network. Virtual traffic mirroring, offered by many platforms, copies packets from selected virtual network interfaces and sends them to a designated target such as a capture appliance or network detection sensor, where full payloads can be recorded and analyzed. Where mirroring is unavailable, capture agents on the workloads themselves achieve similar results. Either approach keeps the investigation within the customer's control and scope. Asking the provider to install a physical tap is not realistic in a multi-tenant environment; shared switches carry other tenants' traffic, and providers do not permit customer-driven physical changes. Flow logs record connection metadata, such as source and destination addresses, ports, protocol, byte counts and the accept or reject decision, but not packet contents, so they cannot reveal command-and-control payloads. Disabling encryption would weaken protection for production data, and load balancer access logs record request metadata rather than full packets, so the change would harm security without achieving capture. Exam caveat: mirrored traffic may itself contain sensitive data and must be protected, retained and handled under evidence procedures. Operational check: confirm the mirror session targets only the in-scope interfaces and that the sensor receives complete packets.