Network traffic analysis is the process of capturing, examining, and interpreting network traffic to Troubleshoot problems, detect anomalies, optimize performance, and investigate security incidents. This document covers packet capture methodology, advanced tcpdump and Wireshark usage, network flow Analysis (NetFlow/sFlow/IPFIX), bandwidth monitoring, and incident response workflows.
The fundamental skill is being able to answer the question: “what is actually on the wire?” — Independently of what you expect to be there.
Choosing the right capture point is the first and most important decision. The wrong capture point Yields misleading or useless data.
SPAN Port (Switched Port Analyzer):
A SPAN port mirrors traffic from one or more source ports to a destination port where the capture Device is connected. Available on most managed switches.
## Cisco IOS SPAN configuration
monitor session 1 source interface Gi0/1 both
monitor session 1 destination interface Gi0/24
Advantages: no hardware cost, works on any switch. Disadvantages: may drop packets under heavy load (ASIC limitations), does not capture errors on the source port, may not mirror all VLAN tags Correctly.
Network TAP (Test Access Point):
A hardware device inserted inline between two network devices. TAPs provide a passive copy of all Traffic (including errors and malformed frames) to the capture device.
[Switch] --- [TAP] --- [Router]
|
[Capture Device]
Advantages: captures everything including errors, no impact on the monitored link, full-duplex Monitoring. Disadvantages: hardware cost, requires physical access to insert, introduces a potential Point of failure.
Inline Capture:
Capture traffic at the endpoint itself (on the server, VM, or container). Uses libpcap to capture Packets as they enter and leave the network interface.
Advantages: captures the endpoint”s perspective (including locally-generated traffic), no additional Hardware. Disadvantages: endpoint CPU overhead, may not capture traffic that the endpoint’s OS drops Before libpcap sees it.
Traffic analysis is like wiretapping a phone system to understand what conversations are happening. A SPAN port is like putting a splitter on a phone line so you can listen in without cutting the connection. A TAP is like a professional recording device that sits inline and captures everything perfectly. The challenge is that modern traffic is mostly encrypted (TLS), so you see the envelope (metadata) but not the letter (content). NetFlow is like keeping a phone log - you record who called whom, when, and for how long, but not what was said. The key insight is that metadata alone is incredibly powerful for troubleshooting and security, even without decrypting the content.
