With so many new trends in the networking world, network monitoring sometimes takes a back seat on industry buzz, even though it’s critical to long-term business success.
Network monitoring encompasses the processes, hardware devices, tools, data and software involved in overseeing network operations. Admins and IT leaders utilize a variety of monitoring tools to optimize their resources, while proactively identifying network bottlenecks and performing targeted troubleshooting.
The Importance of a Baseline Reading
Before networking professionals get too deep into monitoring discussions, baselining should be the first priority. Taking baseline readings of network traffic is the first step for any network to efficiently spot anomalies later on.
Without a proper network traffic baseline, monitoring efforts will fall short because they won’t have anything to compare packet analyses to. There are three key components of the baselining conversation:
- IP Address Access: Network monitoring strategies should begin with a basic IP scan to see which outside addresses are permitted to talk to the network. When unknown IP addresses try to access the network, you will know to look at this activity in need of investigation. With this baseline information, suspicious addresses can quickly be identified before problems occur.
- Balance of Traffic: Both external and internal traffic should be monitored to get a baseline understanding of what the typical balance looks like so anomalies can be spotted later. Start analyzing the data at the WAN - where your company’s network truly begins. Look at the balance of internal traffic versus what is sent externally to examine average load per server and what the usages of key business applications are.
- Peaks vs. Normal Conditions: Every network has its peak hours for traffic. Knowing the on and off times for the network make it clearer when there’s a problem with resource utilization. Hackers often try their best to mimic normal traffic conditions, but they usually end up leaving some sort of trail behind. Seeing peak traffic levels at odd hours may be a sign that something is amuck.
Download Now: Network TAPs 101 - The Networking User Guide [Free eBook]
While baselining should be the first network monitoring technique deployed, admins need a go-to tool for analyzing packets against this initial data. Enter Wireshark.
Wireshark—The Premier Network Monitoring Tool
Over the last 20 years, Wireshark has become synonymous with all network monitoring efforts. As a free, open source packet analyzer used for network troubleshooting, analysis and communications protocol development there’s no wonder it is an industry standard.
The tool first launched as Ethereal in 1998 with a mission of providing a packet capture device for visually solving network issues. In the early days of Ethereal, some users saw it as a convenient tool for trace file translation. Networking pros soon realized it was a viable replacement for expensive network analyzers of the early 2000s.
By the time Ethereal became Wireshark in 2006, the tool’s features extended beyond its packet/data analyzer roots with:
- A SysDig events analyzer
- Metadata views
- And a growing library of integrations for new methods of data, packet, frame, and merged system information capturing.
All these years later, it’s great to look at the differences between Ethereal’s interface and today’s Wireshark interface and see how network monitoring has evolved.
[Looking to add a visibility solution to your next deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do!
