Where network performance management asks whether the network is fast and available, traffic analysis asks what is on the wire. It shows which hosts, applications and protocols use the bandwidth, and it flags patterns that don't belong, such as a database server suddenly sending gigabytes to an unfamiliar address.
How it works
- Flow-based analysis. Routers, switches and cloud platforms export summaries of each conversation: source and destination IP and port, protocol, bytes, packets and timestamps. NetFlow, IPFIX and sFlow are the common formats, and cloud providers offer flow logs such as AWS VPC Flow Logs. Flows are light enough to collect everywhere, but they don't include the content.
- Packet-based analysis. Full packets are captured from mirror (SPAN) ports or network taps and inspected with tools such as Wireshark or tcpdump. This gives the most detail at a high storage cost, and encryption hides most payloads.
- Behavioral analytics. Normal traffic is baselined per host and deviations are flagged. Security vendors now sell this as network detection and response (NDR).
What it's used for
- Capacity and performance: finding the top talkers and applications that fill a link, and planning upgrades.
- Troubleshooting: failed connections, retransmissions, DNS problems and misrouted traffic.
- Security: spotting port scans, lateral movement between internal hosts, regular "beaconing" to command-and-control servers, and large unexpected uploads that suggest data exfiltration.
- Compliance: showing that network segmentation works, for example that card data systems only talk to what they should.
Challenges
- Encryption. Most traffic is now TLS-encrypted, so analysis relies on metadata, such as who connected, when, how much and to which domain, rather than content.
- Volume. Busy networks produce huge amounts of flow and packet data, so sampling and retention need planning.
- Cloud and hybrid blind spots. Traffic between cloud services may never pass a device you can mirror, so cloud flow logs fill the gap.
Network traffic analysis with Atatus
Atatus network monitoring collects NetFlow, IPFIX and sFlow data with the Infrastructure Agent, alongside SNMP device metrics and path tests. On the security side, VPC Flow Logs can feed Atatus SIEM, which runs detection rules mapped to MITRE ATT&CK. See also SIEM.