web runs in public-a; its security group allows port 80 only. The role flow-logs exists.

1. Keep the VPC's id in VPC, and create a flow log that records the VPC's rejected traffic into the log group /market/flow.

2. Put web's public IP in IP and try a port the security group does not allow:

   sh

   copy

   curl -m 3 http://$IP:8080/

3. Read the rejected records of /market/flow, and find the port in the one your curl left.