How to Monitor Network Software

Effective network monitoring and anomaly detection are crucial in managing today's Internet infrastructure.

Network software is the cornerstone for online commerce in the 21st century. Data passing through the Internet are first encapsulated by network software into fragments of information called packets--much like small envelopes. Since people rely so much on network systems including both hardware and software infrastructure, monitoring these systems is paramount to ensuring network operability, availability and security. Monitoring network software and hardware systems consists of three main phases: data capture, decoding and translating (into a human-readable format) and statistical or textual analysis.

Difficulty:

Moderate

Instructions

Things You'll Need

• Computer logs
• Packet capturing software or hardware
• Internet protocol packet decoder

Data Capture

1. Download and install data capturing hardware or software. Data capturing devices, or software, log and monitor raw packets transmitted by network software over a physical medium, such as 802.11 WiFi or Ethernet. Free network traffic monitoring software is available for download for Windows, Mac and Linux operating systems. The most common (and simplest) capturing software is tcpdump for Windows or Linux.

2. Configure data capturing software. Network traffic capturing systems can be set to capture all packets transmitted over a network, or can be set to only store packets matching certain conditions. Information technology personnel commonly filter out network control packets and other automated traffic, instead searching for useful packets by target domain name, IP address or protocol. Most network traffic capturing systems offer fine-grain control over filters, for maximum capturing efficiency and efficacy.

3. Begin monitoring of network software with your data capturing system. Most capturing systems run automatically once configured properly. You can view network traffic in real time, or store it in a capture file for later use. Some network traffic analyzers even allow the user to inject doctored or new packets into a real-time network stream.

Data Decoding and Analysis

1. Decode your data into human-readable format via the use of a network data decoder. Most network packet capture software store traffic in machine-readable format, usually in a modified form of the raw binary that is transmitted over the network. Packet decoders, such as Wireshark, render stored or real time monitoring data into human-readable format, for analysis, sorting or search.

2. Run network software statistical tools to view trends in the data. Often, system administrators look for statistical trends in network monitoring data to view traffic bottlenecks, examine user patterns or detect malicious traffic. Statistical tools separate traffic into categories based on host, port, protocol or even text string to provide a useful analysis to a network manager.

3. Search the network data for target strings or other useful information. The ultimate goal of monitoring network software is to glean useful information about the network traffic from the captured and decoded data. Textual string extraction programs can automate the task of searching for specific information contained in a packet, while traffic replay software can display the network conversation (for web traffic) in a graphical way, such as a slide show or video.

Tips & Warnings

• Always obtain permission from the system administrator or owner before monitoring any network hardware or software system.

References

• Yale University: TCP/IP Network Introduction