A Survey of Network Traffic Monitoring and Analysis Tools

Abstract:

From hundreds to thousands of computers, hubs to switched networks, and Ethernet to either ATM or 10Gbps Ethernet, administrators need more sophisticated network traffic monitoring and analysis tools in order to deal with the increase. These tools are needed, not only to fix network problems on time, but also to prevent network failure, to detect inside and outside threats, and make good decisions for network planning. This paper surveys all possible network traffic monitoring and analysis tools in non-profit and commercial areas. The tools are categorized in three categories based on data acquisition methods: network traffic flow from NetFlow-like network devices and SNMP, and local traffic flow by packet sniffer. The popular tools for each category and their main features and operating system compatibilities are discussed. The feature comparisons on each category are also made.

Table of Contents

• 1. Introduction
• 2. Traffic flow information
  • 2.1 Network traffic flow information (by NetFlow-liked)
    • 2.1.1 Cisco NetFlow
      • 2.1.1.1 Examples of network traffic flow collectors (Flow-tools, cflowd, and flowd)
      • 2.1.1.2 Examples of network traffic flow monitoring and analysis tools (FlowScan, Autofocus, and Fluxoscope)
    • 2.1.2 sFlow (pmacct and InMon Traffic Sentinel)
  • 2.2 Network traffic flow information (by SNMP) (MRTG and Cricket)
  • 2.3 Local traffic flow information (by packet sniffer)
    • 2.3.1 Software sniffer (snoop, tcpdump, Wireshark)
    • 2.3.2 Hardware sniffer (Sniffer)
• 3. Comparison of traffic flow information
• 4. Summary
• 5. References
• 6. List of Acronyms
• 7. Appendix A: List of network traffic monitoring and analysis tools