Last updated at Thu, 04 Mar 2021 20:49:46 GMT
What you should consider if you want to monitor network traffic
There are many good reasons to monitor network traffic. The information obtained by network traffic monitoring tools can be used in multiple security and IT operational use cases to identify security vulnerabilities, troubleshoot network issues, and analyze the impact new applications will have on the network.
However, not all tools for monitoring network traffic are the same. Generally, they can be broken down into two types: flow-based tools and deep packet inspection tools. Within these two types, you have the choice of tools that use/don't use software agents, tools that store/don’t store historical data, and tools with intrusion detection systems that monitor network traffic within the network as well as along the network edge.
Here are our five tips if you are looking to monitor network traffic.
1. Choose the right data source
Whatever your motive for monitoring network traffic, you have two main data sources to choose from:
- Flow data can be acquired from layer 3 devices such as routers
- Packet data can be sourced from SPAN, mirror ports, or TAPs
Flow data is fine if you are looking for traffic volumes and mapping the journey of a network packet from its origin to its destination. This level of information can help detect unauthorized WAN traffic, the utilization of network resources, and network performance. However, flow-based tools for monitoring network traffic lack the detailed data to perform true root cause analysis.
Packet data extracted from network packets can help network managers understand how users are using applications, track usage on WAN links, and monitor for suspicious malware or other security incidents. By transforming the raw metadata into a readable format and enabling network managers to drill down to the minutest detail, deep packet inspection tools provide 100% visibility over the network.
2. Pick the correct points on the network to monitor
Naturally with agent-based software, you have to install software on each device you want to monitor. This is not only an expensive way of monitoring network traffic but also creates a significant maintenance overhead for IT teams. Furthermore, if your objective is to monitor activity on a BYOD or publicly accessible network, agent-based software will not give you the full picture of user activity because it is impractical (and, in some states, illegal) to monitor activity on users’ personal devices.
Even with agent-free software, a common mistake many people make when deploying tools to monitor network traffic is that they try and monitor too many data sources at the start. There is no need to monitor every network point. Instead, you need to pick points where data converges. Examples of this would be internet gateways, ethernet ports on WAN routers, or VLANs associated with critical servers.
If you are new to getting tools in place to monitor network traffic, we suggest you start by monitoring your internet gateway(s). This can be an excellent source of security and operational data.
3. Sometimes real-time data is not enough
The ability to monitor network traffic in real time is sufficient to achieve many objectives of network traffic monitoring, but sometimes, real-time data is not enough. Historical data is just as important if you want to analyze past events, identify trends, or compare current network activity to past weeks. For these objectives, it is best to use tools for monitoring network traffic with deep packet inspection.
Some tools for monitoring network traffic choose to age data. This means the further back you go historically, the less detail you can get. While this can save on disk space, it is not an ideal solution if you are trying to determine how an intruder managed to overcome your defenses to plant malware on the network. Without accurate and complete data relating to the event, you can be left looking for answers that no longer exist.
It is also a good idea to be aware that some SIEM and network traffic monitoring systems base their pricing on the amount of data you want to store. Keep a watchful eye out for this when you are evaluating solutions. Other appliance-based tools are limited based on the specifications of the system you buy, and an upgrade becomes a replacement appliance that can be expensive. The most flexible options are network traffic monitoring tools that are software-based and allow you to allocate whatever disk space you think is appropriate.
Learn more about using network traffic analysis for threat detection and response.
4. Associate the data with usernames
Traditional network traffic monitoring tools usually report on activity using IP or MAC addresses. While this is useful information, it can be problematic in DHCP environments if you are trying to find a problematic device. One piece of information that can bring together network activity and devices is usernames. Username association will let you know who is doing what on the network.
5. Check the flows and packet payloads for suspicious content
Many networks have intrusion detection systems at the network edge, but very few networks have this type of technology monitoring traffic inside the network. All it takes is for one rogue mobile or IoT device for a network to be compromised. Another issue we often see is firewalls allowing suspicious traffic through where a rule was misconfigured.
The image below shows an example of this: Someone created a rule to allow traffic inbound on TCP 5901 (VLC remote desktop sharing), but they did not limit it to one source and destination. The source addresses in this case appear to be registered in China and connections from this country would not be expected from this network.
Summary
These five tips if you are looking to monitor network traffic are flexible depending on your motives for monitoring network traffic, the depth of visibility you need over the network to achieve your objectives, and the resources you have available to address potentially high-maintenance overheads.
Nonetheless they should help you determine the most appropriate tool for network traffic monitoring and the features it should have in order to monitor network traffic effectively. There are a huge amount of solutions available if you want to monitor network traffic. The key is to pick one to match your requirements.
- Choose flow-based analysis tools if you want to get traffic volumes and IP addresses associated with WAN or other layer 3 links
- Choose packet analysis tools if you need traffic volumes, IP addresses, and more detail to investigate security or operational issues.
If you would like to discuss any of the points raised in this article, do not hesitate to contact us.