Network monitoring and analysis tools aren’t new topics by any means, but as with everything, sometimes it’s great to go back to the basics and get a refresher. While security tools and trends tend to get all the attention, it’s important not to forget how important packet capture is to long-term business success. Packet capture is the ultimate troubleshooting tool for your network. After all, if you really want to know what’s going on in the network, you need to capture traffic.
By definition, packet capture refers to the real-time interception of a data packet that crosses or moves over a specific portion of a computer network. Once that packet is captured, it is then stored temporarily to be analyzed by either another tool or the network administrator.
It’s something so simple, but capturing packets from key points in the network can help diagnose and solve any network problems, as well as determining if security protocols are being followed correctly. By comparing captured packets from the same point in a network overtime, you can determine and observe normal behavior, making it easier to identify deviations from the baseline.
The are numerous tools and techniques to use for packet capture, so the network and business requirements will really drive what tool(s) are used. Depending on the use case, capturing just a portion of a packet may be enough, which other times you’ll need to capture the complete packets, which include both the header and payload, so you can access the metadata for source and destination addresses.
Being a free and open source packet analyzer, and who doesn’t like free, Wireshark is commonly used by most network technicians as a preliminary tool for network troubleshooting and analysis. However for most networks, Wireshark will not be enough, so companies will rely on a more advanced tool like the ones from Corelight for a more in depth analysis of the network traffic. To ensure that your packet capture tool gets 100% of the network traffic, industry best practice states to use a network TAP rather than rely on SPAN ports as the access method. SPAN ports often experience packet dropping when ports become oversubscribed and can have degraded performance due to the use of production switches and routers. Network TAPs on the other hand enable packet capture that doesn’t distort or drop data regardless of bandwidth or physical layer errors.
Looking to add a visibility solution to your monitoring deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do!