LEARN. PRACTICE. GROW.Concept and mechanism
Observation is an operational dependency needing an owner and a test. An NLB used as a Traffic Mirroring target depends on its UDP 4789 listener; removing it can interrupt copies without an explicit error indication. Do not confuse this port with UDP 6081 used by GWLB for GENEVE. For stateful inspection, validate forward and return paths, appliance traversal, and failure behavior. An active sensor does not prove it receives every intended source. Define coverage by application, interface, time window, and traffic type, and retain signals detecting coverage loss. The service may remain functional while the team has lost its ability to investigate it.
Guided application
To attribute a route change, combine action records, identity, time, and approval; a throughput graph does not identify the actor. In Flow Logs, fields such as pkt-srcaddr help distinguish packet origin from an intermediate interface, but are not authenticated user identity. Also maintain DNSSEC monitoring with an operational response to signing errors. When FinOps proposes retiring a resource, inspect observation and security dependencies before concluding it has no value. Update mirroring sessions to the new target, validate critical sources, and only then retire the previous target. Record complete cost, owner, evidence, and rollback. This discipline connects project delivery and RUN without reducing handover to a context-free resource list.
The new sensor receives one source but two critical applications are missing. Keep retirement pending until coverage is validated.
Common pitfalls
Active sensor as complete; metric as actor; IP as user; deleting a target before migrating sessions.
Related topics: Addressing, DNS, and connectivity · Transit, load balancing, and DNS trust
Retire resources only after demonstrating their dependencies remain satisfied.
Reference: ANS-C01 domain 4 · ANS-C01