# What Are Network Monitoring and Network Visibility? Traffic, NetFlow and Packet Analysis **URL:** https://securesys.com.tr/en/learning/network-security/network-monitoring-and-visibility ![What Are Network Monitoring and Network Visibility? Traffic, NetFlow and Packet Analysis](/images/bilgi-merkezi/covers/cover-network-08.webp) One of the most critical questions in corporate network security is this: #### If you cannot see what is happening on the network, can you really detect an attack? An organization may have firewall, switch, router, NAC, IDS/IPS and endpoint security products. However, if the real communication patterns on the network are not visible the security team can face an important visibility gap. Because attackers do not always move loudly. Some attacks: a single exploit, a single malware alert, a single failed login may not appear as any of these. Instead of this the attacker: slow network discovery, low-volume C2 communication, periodic beaconing, unusual DNS requests, unexpected East-West traffic, data exfiltration can display quieter behaviours such as these. For this reason modern network security requires not only controlling the traffic but: **understanding the traffic** as well. At this point two fundamental concepts come to the fore: #### Network Monitoring and #### Network Visibility While Network Monitoring focuses more on monitoring the performance and availability state of the network; Network Visibility aims to understand which devices inside the network communicate with which systems and over which protocols and behaviour patterns. From the point of view of modern Network Security a strong approach: **Monitor → Observe → Baseline → Detect → Investigate** works in this way. ### What Is Network Monitoring? Network Monitoring is the process of continuously monitoring the state of network devices, interfaces, services and traffic. The aim; availability, performance, capacity, connectivity and security is to provide visibility on subjects such as these. ### What Does Network Monitoring Monitor? For example: Device Up/Down Interface Status Bandwidth Usage Packet Loss Latency CPU Usage Memory Usage Error Rate ### Is Network Monitoring Used Only for Performance? No. It can also provide important telemetry from a security point of view. ### What Is Network Visibility? Network Visibility expresses the communication taking place on the network being visible in sufficient detail. ### What Should Network Visibility Answer? - Which device is talking? - Who is it talking to? - Which protocol is being used? - How much data is being transferred? - When is the communication established? - Is this behaviour normal? ### What Is the Difference Between Network Monitoring and Network Visibility? Network Monitoring: #### Is the network healthy? Network Visibility: #### What is really happening on the network? they focus on these questions. ### What Is Network Telemetry? Network Telemetry is the general name for the measurement and event data collected from network devices and traffic. ### What Are Examples of Network Telemetry? NetFlow IPFIX sFlow SNMP Syslog PCAP DNS Logs Firewall Logs ### Why Is Telemetry Important? It provides data for detection and investigation. ### Can Detection Be Performed Without Visibility? Only in a limited way. The quality of security detection depends to a large extent on the quality of the visibility. ### What Is North-South Traffic? It is the traffic between the corporate network and the internet or the external environment. ### What Is East-West Traffic? It is the traffic between internal endpoints, servers and workloads. ### Why Is East-West Visibility Critical? Lateral movement most often takes place on internal traffic. ### Is Perimeter Monitoring Enough on Its Own? No. While internet traffic is visible internal traffic may not be. ### What Is an East-West Blind Spot? It is internal network communication not being sufficiently visible to the security tooling. ### What Is a Network Blind Spot? It is the network area the monitoring infrastructure cannot see. ### Why Is a Blind Spot Risky? The attacker can move without detection. ### What Is NetFlow? NetFlow is the technology that provides metadata about traffic behaviour by collecting network flow information. ### What Is a Flow? It is the traffic record that represents the communication session between a particular source and destination. ### What Can a Flow Record Contain? Source IP Destination IP Source Port Destination Port Protocol Bytes Packets Start Time End Time ### Does NetFlow See the Packet Content? No. It generally provides metadata. ### What Is the Advantage of NetFlow? On high-volume networks it can provide broad visibility at a low storage cost. ### Can NetFlow Be Used for Security? Yes. ### What Can Be Detected With NetFlow? Port Scan Unusual Traffic Volume Unexpected Communication Lateral Movement Pattern Beaconing ### What Is IPFIX? IPFIX: #### IP Flow Information Export is the standard used for flow data export. ### What Is the Difference Between NetFlow and IPFIX? IPFIX offers a more flexible and standardized flow export approach. ### Is IPFIX Valuable for Network Security? Yes. It is very valuable for flow-based detection. ### **What Is sFlow?** sFlow is the technology that provides sampled telemetry about network traffic and interface statistics. ### What Is Sampling? It is the analysis of certain samples instead of all packets. ### What Is the Advantage of Sampling? On a high-speed network resource usage can be reduced. ### What Is the Disadvantage of Sampling? Some low-volume activity can be missed. ### Are NetFlow and sFlow the Same? No. The telemetry collection methods are different. ### What Is Flow Analysis? It is the analysis of flow records in terms of network behaviour. ### What Does Flow Analysis Provide? It provides visibility of communication patterns. ### What Is a Top Talker? It is the device or system that produces the most traffic on the network. ### Why Is a Top Talker Important From a Security Point of View? Unexpected high traffic can be a sign of data exfiltration or a compromise. ### What Is a Top Destination? It is the destination with which the most communication is made. ### What Is an Unexpected Destination? It is a target system seen outside normal behaviour. ### What Is a Baseline? It is the normal communication pattern of the network. ### What Can a Network Baseline Contain? Normal traffic volume Normal destination Normal protocol Normal communication time ### Why Is a Baseline Necessary? It provides a reference for anomaly detection. ### What Is an Anomaly? It is a meaningful deviation from normal behaviour. ### What Is Network Anomaly Detection? It is the identification of unusual patterns within network behaviour. ### Is an Anomaly Always an Attack? No. It can be a configuration change or business activity. ### What Is Behavioral Network Analysis? It is the analysis of the behaviour patterns of the traffic over time. ### Why Is Behavioral Analysis Strong? It can help to detect threats that have no known signature. ### What Is Beaconing? It is the endpoint establishing a connection to the same destination at certain intervals. ### Why Is Beaconing Important? It can be an indicator of Command and Control behaviour. ### What Is C2? C2: #### Command and Control is the control communication between the compromised device and the attacker infrastructure. ### Can NetFlow Detect C2? It can help through the periodic communication pattern. ### What Is DNS Telemetry? It is the use of DNS query and response information for security monitoring. ### Why Are DNS Logs Valuable? They can show which domains the endpoint is trying to reach. ### What Is an Unusual DNS Query? It is a DNS request seen outside normal business behaviour. ### What Is DNS Tunneling? It is data transfer or command communication being performed over the DNS protocol. ### How Can DNS Tunneling Be Detected? Query length Query frequency Subdomain entropy Behaviour pattern these can be analyzed. ### What Is Domain Entropy? It is the level of randomness of the domain/subdomain character structure. ### What Is DGA? DGA: #### Domain Generation Algorithm is the algorithm malware uses to produce dynamic domains. ### What Is DGA Detection? It is the detection of algorithmically generated domain patterns. ### What Is SNMP? SNMP: #### Simple Network Management Protocol is the protocol used for network device monitoring and management. ### What Does SNMP Provide? Interface status CPU usage Memory usage Traffic counter it can provide information such as this. ### Can SNMP Be Used for Security? Indirectly, yes. Abnormal network device behaviour can be detected. ### Why Is SNMPv3 Important? It provides authentication and encryption capability. ### Is the SNMPv2 Community String Risky? A weak or default community string can create a security risk. ### What Is Syslog? It is the logging mechanism that allows network and security device events to be sent to a central log system. ### On Which Devices Is Syslog Used? Firewall Switch Router WLC IDS/IPS on systems such as these. ### Why Is Syslog Important for Security Monitoring? It provides event correlation and forensics. ### What Is the Difference Between Syslog and NetFlow? Syslog: Provides event information. NetFlow: Provides traffic metadata. ### What Is PCAP? PCAP: #### Packet Capture is the recording of network packets. ### What Is Packet Capture? It is the storing of network traffic at the raw packet level. ### Why Is PCAP Powerful? It provides the most detailed analysis of network communication. ### What Does PCAP Show? Header Protocol Payload Timing Session behaviour ### What Is the Disadvantage of PCAP? The storage need is high. ### What Is Full Packet Capture? It is the recording of all network packets. ### Should Full Packet Capture Be Performed Everywhere? No. Storage, privacy and performance must be evaluated. ### What Is Selective Packet Capture? It is the recording of only certain traffic. ### What Is Triggered Packet Capture? It is packet capture being started when a certain event occurs. ### What Is Ring Buffer Capture? It is the capture model in which the oldest packets are overwritten when a certain amount of storage is full. ### Why Is PCAP Valuable for Forensics? The network communication before and after the incident can be analyzed. ### What Is a Packet Header? It is the section that contains the packet routing and protocol information. ### What Is a Payload? It is the actual application data carried inside the packet. ### Can an Encrypted Payload Be Seen? It is seen in encrypted form. ### Can TLS Traffic Be Read in a PCAP? If there is no decryption capability the payload cannot be read. ### Is Packet Metadata Still Valuable? Yes. Timing and communication behaviour can be seen. ### What Is DPI? DPI: #### Deep Packet Inspection is the detailed analysis of the packet payload and protocol information. ### Where Is DPI Used? NGFW IDS/IPS NDR in security systems such as these. ### Is DPI Affected by Encryption? Yes. Encrypted traffic reduces payload visibility. ### What Is SSL/TLS Inspection? It is encrypted traffic being decrypted for security analysis. ### Should TLS Inspection Be Applied to All Traffic? No. Privacy, performance and application compatibility must be evaluated. ### What Is SPAN? SPAN: #### Switched Port Analyzer makes it possible for switch traffic to be copied to another port. ### Why Is a SPAN Port Used? In order to provide traffic to an IDS, NDR or packet capture system. ### What Is the Disadvantage of SPAN? In a high traffic situation packet drop can occur. ### What Is a Network TAP? It is the visibility device that makes it possible for the traffic on a network link to be copied to a monitoring system. ### What Is the Difference Between a TAP and SPAN? A TAP provides a dedicated traffic copy. SPAN uses switch resources. ### Is a TAP More Reliable? It can provide an advantage for high-fidelity monitoring. ### What Is a Packet Broker? It is the system that directs the traffic coming from different TAP/SPAN sources to the monitoring tools. ### Why Is a Network Packet Broker Used? Traffic aggregation filtering deduplication load balancing it can provide these. ### What Is Packet Deduplication? It is preventing the same packet from being sent to the monitoring tool more than once. ### What Is a Visibility Fabric? It is the architecture that provides network telemetry and packet visibility centrally. ### What Is Network Observability? It is the advanced visibility approach aimed at understanding not only the state of the network but its behaviour and root cause. ### What Is the Difference Between Monitoring and Observability? Monitoring tracks known metrics. Observability tries to understand system behaviour through broader telemetry. ### What Is Network Performance Monitoring? It is the monitoring of network latency, bandwidth and availability. ### What Is Network Performance Monitoring and Diagnostics - NPMD? It is the approach or platform class focused on the detection and analysis of network performance problems. ### What Is Bandwidth Monitoring? It is the monitoring of the network interface traffic volume. ### What Is a Bandwidth Spike? It is a sudden traffic increase above the normal. ### Can a Bandwidth Spike Be an Attack Indicator? It can be a sign of DDoS or data exfiltration. ### What Is Packet Loss? It is network packets not reaching the destination. ### Does Packet Loss Affect Security Tools? Yes. The monitoring sensor can miss packets. ### What Is Latency? It is the delay in a packet reaching the destination from the source. ### What Is Jitter? It is the variability in packet delay times. ### What Is Error Rate? It is the error rate in interface or network communication. ### What Is a CRC Error? It is an indicator of a frame integrity problem. ### Why Is Network Health Important for Security? Security sensor performance can be affected by network health. ### What Is Network Device Monitoring? It is the monitoring of switch, router and firewall health information. ### What Is Interface Monitoring? It is the tracking of port status and traffic information. ### What Is Interface Flapping? It is a network port continuously going up and down. ### Can Interface Flapping Be a Security Event? Sometimes it can be a physical problem, sometimes an unauthorized connection. ### What Is New Device Detection? It is the identification of a device not seen before on the network. ### What Is a New MAC Address Alert? It is a new MAC address being seen on the switch or NAC. ### What Is Unknown Device Detection? It is the detection of devices that are not in the asset inventory. ### What Is Shadow IT Visibility? It is making systems and services not known by IT visible. ### What Is Network Discovery Monitoring? It is the detection of internal scan and discovery activities. ### Can a Port Scan Be Detected With Flow Data? Yes. ### How Does a Horizontal Scan Look? One source IP: a large number of destinations the same port ### How Does a Vertical Scan Look? One source: a single destination a large number of ports ### Why Is a Slow Scan Difficult? Low-and-slow behaviour can remain below the baseline. ### Why Is Long-Term Telemetry Important? Slow attacks can be seen over time. ### What Is Time-Series Analysis? It is the analysis of telemetry along the time axis. ### What Is a Traffic Trend? It is the change in network activity over time. ### What Is Seasonality? They are the daily or weekly repeating patterns of network behaviour. ### What Is a Normal Office Hours Baseline? It is the profile of network activity according to working hours. ### What Is After-Hours Traffic? It is communication outside normal working hours. ### Is After-Hours Traffic Suspicious? It depends on the context. ### What Is Data Exfiltration? It is sensitive data being taken outside the organization without permission. ### Can Network Visibility Detect Data Exfiltration? Yes. Unusual traffic volume and destination behaviour can be evaluated. ### What Is a Large Outbound Transfer? It is an external data transfer of a higher amount than normal. ### What Is Low-and-Slow Exfiltration? It is data being taken out in small pieces over a long period in order to escape detection. ### How Is Low-and-Slow Exfiltration Detected? A behavioural baseline and long-term telemetry are needed. ### What Is Protocol Abuse? It is the use of a legitimate protocol for a malicious purpose. ### What Is HTTP Tunneling? It is covert communication being carried over the HTTP/HTTPS protocol. ### What Is ICMP Tunneling? It is data communication being performed over ICMP traffic. ### Can Network Telemetry Detect Protocol Abuse? It can help through behaviour anomalies. ### What Is Network Metadata? They are the data that provide information about communication without the payload. ### Examples of Metadata IP Port Protocol Bytes Timing Duration ### Is Metadata Enough for Security? It is valuable for many detections but PCAP may be needed for a full investigation. ### A Comparison of Flow and PCAP | Feature | Flow | PCAP | | --- | --- | --- | | Storage | Low | High | | Detail | Metadata | Full Packet | | Long-Term Retention | Easy | Difficult | | Forensic Detail | Medium | Very High | | Behavioral Analysis | Strong | Strong | ### NetFlow or PCAP? The strongest approach is to use the two together. ### What Is Tiered Visibility? It is the use of telemetry at different levels of detail. For example: Long-Term NetFlow Short-Term PCAP ### What Is Network Telemetry Retention? It is how long the telemetry data is stored. ### Why Is Retention Important? An incident is sometimes noticed weeks later. ### What Is Historical Network Data? They are the records of past network behaviour. ### Why Is Historical Data Valuable for Incident Response? It can answer the question "When did the first communication begin?" ### What Is Network Forensics? It is the detailed analysis of network traffic and telemetry during an incident. ### Which Data Does Network Forensics Use? PCAP NetFlow DNS Logs Firewall Logs ### What Is Timeline Analysis? It is the reconstruction of the incident activity in time order. ### What Is First Seen? It is the time an IP, domain or behaviour was first seen. ### What Is Last Seen? It is the time the activity was last seen. ### What Is Network IOC Hunting? It is the searching for known malicious indicators in historical network data. ### What Is an IOC? Indicator of Compromise. ### An IOC Hunting Example A malicious IP has been learned. ↓ The last 30 days of flow data is searched. ↓ Which endpoints established communication is found. ### What Is Threat Hunting? It is the proactive searching for potential threat behaviour without an existing alarm. ### What Is Network Threat Hunting? It is the searching for suspicious communication patterns through network telemetry. ### What Is a Hunt Query? It is the query that tests a particular hypothesis on the telemetry. ### Does Threat Hunting Need a Baseline? Yes. Without knowing the normal the abnormal cannot be interpreted. ### The Relationship Between Network Visibility and Asset Inventory Traffic monitoring can show the devices that are really active on the network. ### What Is Passive Asset Discovery? It is asset detection through traffic without sending an active scan to the device. ### Why Is Passive Discovery Useful? It can be safer in OT and sensitive environments. ### What Is Active Discovery? It is assets being detected using a network scan. ### Can Active and Passive Discovery Be Used Together? Yes. ### What Is Application Discovery? It is the determination of which applications and protocols are being used on the network. ### What Is Application Dependency Mapping? It is the determination of which systems applications establish communication with. ### Is Flow Data Used for Dependency Mapping? Yes. ### Why Is Dependency Mapping Important for Segmentation? The real communication needs are understood before a firewall rule is applied. ### What Is Unauthorized Protocol Detection? It is the detection of the use of protocols not permitted in the policy. ### What Is a Shadow Protocol? It is the communication type that should not be used corporately but is seen on the network. ### What Is Legacy Protocol Detection? It is the identification of the use of old and risky protocols on the network. ### Is Seeing Telnet Traffic Risky? Yes. The use of an unencrypted protocol is a security risk. ### Should FTP Traffic Be Monitored? Yes. Clear-text use in particular must be evaluated. ### Why Is SMB Traffic Visibility Important? It is valuable in the analysis of lateral movement and file sharing behaviour. ### Why Is RDP Traffic Visibility Important? It is valuable for remote administration and lateral movement detection. ### Why Is SSH Traffic Visibility Important? It is valuable for admin access and unusual remote connection analysis. ### What Is Database Traffic Monitoring? It is the monitoring of the network connections made to database servers. ### What Is a Database Network Baseline? It is the normal model of which application servers connect to which database ports. ### What Is an Unexpected Database Connection? It is database access outside the normal application path. ### Why Is Backup Traffic Monitoring Important? Unexpected communication to backup servers can be a sign of ransomware or lateral movement. ### Why Is Management Network Monitoring Important? Management interfaces are critical assets. ### Should Seeing Traffic From the User VLAN to the Management VLAN Be an Alarm? According to the policy it can be a high-value detection. ### What Is Network Segmentation Violation Detection? It is a connection attempt being seen between segments that normally should not reach one another. ### Should a Segmentation Violation Be Sent to the SIEM? Yes. ### Why Is Denied Traffic Monitoring Important? Firewall deny events can be an indicator of reconnaissance and policy violation. ### Is Allowed Traffic More Important? Both are important. Because an attack can also take place over permitted traffic. ### What Is Network Log Correlation? It is the analysis of different telemetry such as flow, firewall and authentication logs together. ### Does the SIEM Provide Network Visibility? The SIEM provides log-based visibility. It does not take the place of raw packet visibility. ### Does NDR Provide Network Visibility? Yes. It provides strong visibility over network telemetry and behaviour analysis. ### What Is NDR? NDR: #### Network Detection and Response is the security technology that provides threat detection and investigation through network traffic and telemetry. ### What Is the Difference Between NDR and Network Monitoring? Network Monitoring: Performance and availability. NDR: Security detection and response. ### Can NDR Use NetFlow? Yes. ### Can NDR Use PCAP? Some solutions can use full or selective packet data. ### Is Network Visibility Fundamental for NDR? Yes. Without visibility behavioural detection weakens. ### What Is the Network Detection Pipeline? Telemetry ↓ Normalization ↓ Baseline ↓ Analytics ↓ Detection ↓ Alert ### What Is Data Normalization? It is the conversion of different telemetry formats into a common model. ### What Is Enrichment? It is the addition of extra context to the telemetry. ### Examples of Enrichment Asset Criticality User Identity Threat Intelligence GeoIP ### What Is Context-Aware Detection? It is the evaluation of network activity with business and asset context. ### What Is Risk-Based Detection? It is the analysis of threat severity together with asset criticality. ### Example Unknown External Connection Domain Controller = High Risk ### What Is Network Security Analytics? It is the processing of network telemetry with analytical methods for the purpose of detection and investigation. ### What Is Statistical Detection? It is the analysis of statistical deviations in traffic metrics. ### Is Machine Learning Used in Network Detection? Yes. It can be used for behaviour baselines and anomaly detection. ### Does Machine Learning Get Every Alarm Right? No. False positives are still possible. ### Why Is Explainability Important? The analyst must be able to understand why the detection occurred. ### What Should a Network Monitoring Dashboard Show? Traffic Volume Top Talkers Interface Health Protocol Distribution ### What Should a Security Visibility Dashboard Show? External Connections Unusual Flows Segmentation Violations Beaconing Unknown Devices ### Network Security KPIs For example: Telemetry Coverage NetFlow Coverage Critical Segment Visibility Log Collection Coverage ### Network Security KRIs Blind Spot Count Unknown Asset Count Sensor Packet Loss Logging Failure ### What Is Visibility Coverage? It is how much of the network can be seen by the monitoring system. ### How Is Telemetry Coverage Measured? By the flow/log/packet visibility ratio of the critical network segments. ### What Is Sensor Health Monitoring? It is the verification that the monitoring sensors are receiving real traffic. ### What Is a Silent Monitoring Failure? It is the sensor not receiving traffic despite appearing to be working. ### What Is a Telemetry Gap? It is the expected network data not arriving. ### Should a Telemetry Gap Be an Alarm? Yes. The monitoring system itself must be monitored too. ### What Is Network Monitoring High Availability? It is the monitoring infrastructure working redundantly. ### What Is a Collector? It is the system that receives the network telemetry. ### What Is a Flow Collector? It is the system that collects NetFlow/IPFIX records. ### What Is Collector Capacity Planning? It is the sizing of the collector according to the flow volume and retention need. ### What Is Events Per Second - EPS? It is the number of events processed per second. ### What Is Flows Per Second - FPS? It is the number of flows processed per second. ### Why Is FPS Capacity Important? In a high-volume environment it prevents telemetry loss. ### What Is Log Storage Planning? It is storage planning according to the retention need of the telemetry. ### Can Data Compression Be Used? Yes. It can reduce the cost of historical telemetry storage. ### What Is Hot Storage? It is recent data that is accessed quickly. ### What Is Cold Storage? It is longer term low-cost telemetry storage. ### Is There a Network Telemetry Privacy Risk? Yes. Packets and metadata can contain sensitive information. ### Can a PCAP Contain Sensitive Data? Yes. ### Should Packet Capture Access Be Limited? Definitely. ### What Is Network Monitoring RBAC? It is the limiting of access to monitoring data according to role. ### Should the Monitoring Admin Account Be Shared? No. ### Should There Be an Audit Log on the Monitoring Platform? Yes. ### What Is Network Monitoring Security Hardening? It is the protection of the monitoring servers and collectors with secure configuration. ### Why Is the Monitoring Platform a High-Value Target? It contains broad visibility about the network and sensitive data. ### Should the Monitoring System Be on the Management Network? According to the architecture it can be kept in a protected management segment. ### Should the Network Monitoring Platform Be Opened to the Internet? As far as possible, no. ### Should the Monitoring Platform Be Backed Up? Yes. The configuration and historical data must be protected on a risk basis. ### What Is a Network Visibility Assessment? It is the analysis of how much of which areas of the network are visible. ### How Is a Visibility Assessment Performed? Network Topology ↓ Telemetry Source Mapping ↓ Blind Spot Analysis ↓ Coverage Improvement ### What Is a Telemetry Source Map? It is the map that shows which network device produces which telemetry. ### How Is a Network Visibility Architecture Designed? A layered approach can be applied: Device Metrics ↓ Flow Telemetry ↓ Security Logs ↓ Selective PCAP ↓ Analytics ### The Most Frequently Made Mistakes in Network Visibility The mistakes frequently seen in organizations: - Performing only bandwidth monitoring - Not seeing East-West traffic - Not using NetFlow/IPFIX - Not checking the SPAN capacity - Not monitoring packet loss - Not collecting DNS telemetry - Not analyzing firewall allowed traffic - Not planning PCAP retention - Not identifying monitoring blind spots - Not monitoring unknown devices - Not creating a network baseline - Not correlating the telemetry with the SIEM/NDR - Not performing collector capacity planning - Not hardening the monitoring platform - Not creating a telemetry gap alarm ### Network Monitoring and Visibility Checklist - Is the network topology up to date? - Are the critical segments defined? - Is NetFlow/IPFIX active? - Are DNS logs being collected? - Are the firewall logs central? - Is switch/router syslog active? - Is SNMPv3 being used? - Is East-West traffic visible? - Is North-South traffic visible? - Is the SPAN/TAP coverage sufficient? - Is packet drop being monitored? - Is there PCAP capability? - Is the flow retention sufficient? - Has a network baseline been created? - Is there anomaly detection? - Is there unknown device detection? - Does the network telemetry go to the SIEM? - Is NDR being used? - Is collector health being monitored? - Is the visibility gap evaluated regularly? ### Network Visibility Maturity Model #### Level 1 - Availability Monitoring Device up/down and bandwidth are monitored. #### Level 2 - Central Logging Syslog and device logs are collected centrally. #### Level 3 - Flow Visibility Network communication becomes visible with NetFlow/IPFIX. #### Level 4 - Behavioral Visibility Baselines, anomaly detection and NDR are used. #### Level 5 - Continuous Network Observability Flow, packet, identity, threat intelligence and automation are used together. ### Frequently Asked Questions #### What is Network Monitoring? Network Monitoring is the continuous monitoring of the state of network devices, interfaces, traffic and performance. #### What is Network Visibility? Network Visibility is being able to see which systems inside the network establish communication with which protocols and destinations. #### What is Network Telemetry? They are the data that provide information about network activity such as NetFlow, IPFIX, SNMP, Syslog, DNS logs and PCAP. #### What is NetFlow? NetFlow is the flow telemetry technology that produces metadata about network communication such as source, destination, port, protocol and traffic volume. #### What is IPFIX? IP Flow Information Export is the standard that makes it possible to export network flow data. #### **What is sFlow?** It is the telemetry technology that analyzes network traffic with the sampling method. #### What is PCAP? Packet Capture is the recording of raw network packets for analysis. #### What is a SPAN Port? It is the port mirroring mechanism that makes it possible for switch traffic to be copied to a monitoring system. #### What is a Network TAP? It is the visibility device that carries the traffic on a network link to the monitoring system. #### What is DPI? Deep Packet Inspection is the detailed security analysis of packet header and payload information. #### What is East-West Traffic? It is the network communication between internal endpoints, servers and workloads. #### What is North-South Traffic? It is the traffic between the corporate network and an external network or the internet. #### What is a Network Baseline? It is the normal communication and traffic behaviour profile of the network. #### What is a Network Anomaly? It is a meaningful deviation from normal network behaviour. #### What is the relationship between Network Visibility and NDR? NDR provides visibility from flow, packet and other network telemetry sources in order to be able to perform threat detection. ### Conclusion: You Cannot Protect the Network You Cannot See Network Security does not consist only of blocking traffic. A strong security architecture at the same time: **continuously seeing and understanding the network** requires this. Because after entering the network the attacker does not have to use completely new protocols. Legitimate: DNS, HTTPS, SMB, RDP, SSH they can move over protocols such as these. In this case looking only at: **"Is the port open?"** this question is not enough. The question that must be asked is this: **"Is this communication normal?"** For this reason the modern Network Visibility approach: **Metadata + Packet + Identity + Context** must be built on these. NetFlow and IPFIX make it possible to understand long-term communication patterns. Syslog and firewall logs provide event context. PCAP gives forensic-level detail when needed. DNS telemetry makes external communication behaviour visible. When these data are used together the organization can answer the following questions: #### Who is talking? #### Who are they talking to? #### Which protocol is being used? #### Is this normal? #### Has it been seen before? #### Is it risky? The fundamental chain of modern network detection: **Visibility → Baseline → Analytics → Detection → Investigation** is in this form. For this reason Network Visibility is not merely an operational monitoring subject. At the same time it is: **the foundation of Threat Detection.** And one of the most critical principles from the point of view of network security is this: **You Cannot Protect What You Cannot See.**