A multipurpose, distributed lan traffic monitoring tool

As the use of Local Area Networks (LANs) increases, and users become more sensitive to network downtime, it is important to be able to provide the network manager with mechanisms to monitor network performance. Monitoring tools should provide reduction and statistical analysis of traffic data, as well as displays that format the collected information in a meaningful and understandable output. Many approaches can be taken to achieve this monitoring goal. This paper describes a distributed monitoring system that comprises one or more high-speed hardware monitoring engines, which perform the network traffic sampling and do initial data reduction, and a set of software functions, which perform further data reduction and traffic analysis. The hardware monitoring engine monitors the wire itself, facilitating the detection of all traffic, not just traffic to or from known entities. The monitor communicates with a remote system, or host, running an integrated set of software functions and providing a user interface to these functions.