A multipurpose, distributed lan traffic monitoring tool

Abstract

A description is given of a distributed monitoring system that comprises one or more high-speed hardware monitoring engines, which perform the network traffic sampling and do initial data reduction, and a set of software functions, which perform further data reduction and traffic analysis. The hardware monitoring engine monitors the wire itself, facilitating the detection of all traffic, not just traffic to or from known entities, The monitor communicates with a remote system, or host, running an integrated set of software functions and providing a user interface to these functions. Monitoring the wire itself allows the monitoring complexity to be off-loaded from all of the network entities being monitored to the hardware monitoring engines, thereby decreasing the cost of data collection software having to be built into all of the entities being monitored. This is especially advantageous in multivendor, multiprotocol environments, where it is not usually possible to require that each entity in the network implements the necessary data collection function.