Network Monitoring Devices

• Common types of network monitoring devices include network sniffers and firewalls.network connection image by stresskiller from Fotolia.com
  
  Network monitoring devices intercept, decode and interpret traffic over a local or Internet network. While most network monitoring devices are software-based, there are a few commercially available hardware traffic capture and analysis systems, called IDS (Intrusion Detection Systems). System administrators and information technology (IT) security personnel utilize network monitoring devices to ensure normal network bandwidth, enforce appropriate use policy and to prevent malicious traffic from entering an enterprise or government network system.
  
  

Packet Sniffer

• Packet sniffers are general tools for intercepting and decoding network traffic. Working at the interface level, these software or hardware devices copy raw data from network infrastructure to a machine-readable file called a dump file for processing and interpretation. Advanced interception tools provide means of decoding these files, filtering out uninteresting traffic, and detailed network statistical tools for administrators to glean the best possible information from the traffic capture. Some of the most common packet sniffers in use today are Wireshark (for Windows, Mac and Linux), Tcpdump and Kismet.
  
  

Firewall

• Most businesses, large-scale organizations and even home users rely on firewalls to prevent unauthorized or malicious traffic from penetrating a network. System administrators monitor firewall logs for traffic anomalies, then can create new firewall rules to block specific traffic patterns as needed. Firewalls are required on most U.S. government systems and must be approved under the FIPS-140 protocol. Firewalls are strongly recommended for any home or business network because when configured properly, they significantly reduce the risk of hacker activity on a network.
  
  

Intrusion Detection System

• Intrusion detection systems (IDS) are smart combined versions of packet sniffers and firewalls that work to automatically detect malicious or inappropriate network traffic and block it without user intervention. Packet anomaly detection algorithms use whitelists and blacklists to allow and block access to specific network hosts, while statistical summary tools analyze and detect patterns in traffic that may be harmful to network activity, for example, denial-of-service attacks. Snort and the Astaro Security Suite are the most common IDS units available today.
  
  

Packet Analyzers

• Packet analyzers, special forms of packet sniffers, are used to glean useful data from network traffic. Information technology personnel frequently use packet analyzers to find inappropriate traffic in a business network, such as an employee playing Internet games during work hours. Packet analyzers look at the hostname or Universal Resource Locator (URL) fields of a DNS (Domain Name System) packet and the IP (Internet Protocol) address of other packets to determine which sites are being visited. Advanced detection systems also inspect packet contents to determine the type of data being transmitted.