Network Packet and Traffic Analysis What is Network Traffic Analysis (NTA)?
Network traffic analysis (NTA) is a method of monitoring network availability and activity to identify anomalies, including security and operational issues. Common use cases for NTA include:
- Collecting a real-time and historical record of what’s happening on your network
- Detecting malware such as ransomware activity
- Detecting the use of vulnerable protocols and ciphers
- Troubleshooting a slow network
- Improving internal visibility and eliminating blind spots
Implementing a solution that can continuously monitor network traffic gives you the insight you need to optimize network performance, minimize your attack surface, enhance security, and improve the management of your resources. However, knowing how to monitor network traffic is not enough. It’s important to also consider the data sources for your network monitoring
tool; two of the most common are flow data (acquired from devices like routers) and packet data (from SPAN, mirror ports, and network TAPs).
The key benefits of network traffic analysis
With the “it’s not if, it’s when” mindset regarding cyber attacks today, it can feel overwhelming for security professionals to ensure that as much of an organization’s environment is covered as possible. The network is a critical element of their attack surface; gaining visibility into their network data provides one more area they can detect attacks and stop them early. Benefits of NTA include:
- Improved visibility into devices connecting to your network (e.g. IoT devices, healthcare visitors)
- Meet compliance requirements
- Troubleshoot operational and security issues
- Respond to investigations faster with rich detail and additional network context
A key step of setting up NTA is ensuring you’re collecting data from the right sources. Flow data is great if you are looking for traffic volumes and mapping the journey of a network packet from its origin to its destination. This level of information can help detect unauthorized WAN traffic and utilize network resources and performance, but it can lack rich detail and context to dig into cybersecurity issues.
Packet data extracted from network packets can help network managers understand how users are implementing/operating applications, track usage on WAN links, and monitor for suspicious malware or other security incidents. Deep packet inspection (DPI) tools provide 100% visibility over the network by transforming the raw metadata into a readable format and enabling network and security managers to drill down to the minutest detail.
Views: 6
