Traffic Mirroring with UDP: VPC traffic mirroring sends mirrored traffic as UDP packets encapsulated in VXLAN (Virtual eXtensible Local Area Network). Therefore, the target for traffic mirroring must have a UDP listener to accept the mirrored traffic.

NLB as a Target: The Network Load Balancer (NLB) can be configured as the target for traffic mirroring. By setting up a UDP listener on the NLB, it can properly receive the VXLAN-encapsulated mirrored traffic and forward it to the EC2 instances behind it.

Correct Listener Protocol: Since mirrored traffic uses UDP, setting up a TCP listener or using both TCP and UDP listeners will not work. Only a UDP listener can correctly handle the traffic.