NetFort Advertising

Why You Need to Monitor Network Traffic on Your Network?

As many of our customers say “packets don’t lie”. Network traffic is an excellent data source if you want more internal visibility to immediately identify anomalies, including both security and operational issues. By monitoring network traffic, you can find out what users are doing on your network without the need for client or agent software. Use cases include:

  • Troubleshoot bandwidth problems
  • Get an audit trail of file and folder activity
  • See what is happening on your Internet gateways
  • Get a real-time and historical record of what is happening on your network

Implementing a solution which can monitor network traffic gives you the insight you need to optimize network performance, enhance security and improve the management of your resources. However, knowing how to monitor network traffic is not enough. You need to select a tool to achieve the detail you require. The image below shows an example of a traffic analysis report from our LANGuardian application.

Image showing top applications which was created using a tool to monitor network traffic

You also need to consider a data source for your network traffic monitoring tool. For example, flow analysis tools to “monitor” network activity only provide top-level information such as the source, destination of traffic, and its volume. They are inefficient at monitoring applications which use multiple TCP or UDP ports, and conversations with CDNs.

Similarly, agent-based software is impractical for networks with multiple sites and organizations providing BYOD or public access wireless networks. The image on the right shows a sample output from a flow based tool.

Traffic Graphs

If you want to monitor traffic on your network you should choose a tool capable of deep packet inspection – and agent-free – in order to drill down into all network´s traffic. Such tools are vendor agnostic and can be very easily implemented at any location on any network and inspect every conversation in depth. If you have a problem, you have the information you need to see what happened. Tools such as Wireshark are great for troubleshooting specific problems, but can become overwhelming if you want to monitor all traffic on your network.

Network Traffic Monitoring with Deep Packet Inspection

Network traffic monitoring solutions which include deep packet inspection use wire data analytics to capture metadata from network packets. They look within the metadata to see what payloads the packets contain. Real-time information is provided about user activity, application activity, web activity, etc., in a format administrators can drill down into in order to monitor all network traffic in phenomenal detail.

capturing metadata from network traffic

The application aware LANGuardian network traffic analysis engine extracts and only retains critical details resulting in a massive 400:1 data reduction and simplifies unnecessary data complexity.  Easier to read than traditional traffic flows,  NetFort metadata describes flows, events and inventory on the network. NetFort user data is metadata combined with Active Directory logins to show who did what.

The image below shows the output of a LANGuardian file activity report. The data this report is extracted from network traffic, so there is no need to enable auditing on file servers.

user file activity

The deep packet inspection process effectively provides a continuous health check on network and user activity. In order to optimize network performance, enhance security, and improve resource management, admins can set up alerts for suspicious activity warnings and conduct network forensics via a central management portal – in real time or using historical data.

– in order to optimize network performance, enhance security and improve resource management.

The difference between traffic based analysis systems and flow-based tools has been likened to a letter going through the mail. Flow analysis tools count the letter, see where it has come from and where it is going. Deep packet inspection opens the letter, reads its content, raises an alert if an anomaly exists, and files a copy of the letter for later reference.

How to Monitor All Network Traffic Agent-Free

Network traffic monitoring tools that use agents require software to be installed on every device that connects to the network. Although this may be an acceptable maintenance overhead for IT teams that support small LANs, it is impractical for large networks and WAN networks with multiple or remote sites. Agent-based tools are also ineffective on BYOD or public access wireless networks because agents cannot be installed on end user devices and therefore, activity by these devices cannot be monitored.

In order to monitor all network activity agent-free, the network traffic monitoring tool captures all network traffic metadata for analysis and observation on the central management portal, without interacting with other devices or impacting network performance. This includes data relating to applications that “port hop”, conversations with CDNs, and activity conducted by users connecting wirelessly to the network.

In order to monitor all WAN network activity at multiple sites, sensors are deployed on the remote physical or virtual platforms. Metadata is captured by the sensors and sent for analysis at the central location. Administrators have visibility across the organization´s entire network, and can monitor all network traffic from a single reference point with the same degree of depth as if the traffic had traversed the local network.

The image below shows a good approach when it comes to network traffic monitoring for most networks. A SPAN or mirror port is configured at the network core, which allows the capture of any traffic passing through. This enables me to capture traffic going to and from the Internet as well as traffic associated with important servers.

Monitoring network traffic using a SPAN or mirror port

Monitor All Your Network Traffic Free for Thirty Days

LANGuardian is an industry leading network traffic monitoring tool that, unlike other packet capture and deep inspection tools, runs on industry standard hardware and virtualized environments. Quick to download and easy to deploy, LANGuardian generates and stores metadata in rich detail to help administrators improve network performance, security, and management by providing total visibility across an organization´s entire network.

LANGuardian is trusted by users all over the world to monitor network traffic. If you would like to evaluate the LANGuardian network traffic monitoring tool in your own environment, download the free trial now. In under an hour, you can implement it at any location and find out what is really happening on your own network.

Discover/learn more in this blog post which looks at our top 5 tips for monitoring network traffic.

If you have any questions about how to monitor traffic on your network using LANGuardian, or would like to know more about how our network traffic monitoring tool can meet your organization´s requirements, do not hesitate to contact us and speak with a member from our technical support team. Please note that by downloading the free trial of LANGuardian or by contacting us for any other purpose, you are under no obligation to subscribe to our service at any time.