Computer Networking
Learn computer networks, Wi-Fi, routers, IP addressing, network protocols, troubleshooting, and network security through practical guides and step-by-step explanations.
Network Security · Visibility and Analysis
Network Monitoring: How to Observe, Understand and Protect a Network
Network monitoring helps administrators understand whether devices are available, connections are working correctly, and traffic is behaving as expected. For security defenders, it also provides evidence that can help uncover suspicious activity and investigate incidents.
Network overview
Concept diagramNetwork traffic
Connections and data flows
Device health
Availability and performance
Example metrics
These graphics are illustrative only. They do not display live network measurements.
01 · Fundamentals
What is network monitoring?
Network monitoring is the ongoing observation of network devices, connections, traffic and services. It helps teams identify outages, performance problems and activity that needs closer inspection.
Availability monitoring
Checks whether routers, switches, servers and other important devices or services are reachable and operating.
Performance monitoring
Measures bandwidth, latency, packet loss, interface utilization and other indicators that affect network quality.
Security monitoring
Examines relevant traffic, logs and events for unusual patterns, unauthorized connections or other potential warning signs.
VISUAL DIAGRAM 01
How network monitoring works
Monitoring systems collect observations, organize them and help people identify problems.
Step 1
Network devices
Routers, switches, servers, endpoints and connections
Step 2
Data collection
Metrics, logs, flow records or selected packet captures
Step 3
Monitoring dashboard and alerts
Measurements, trends, events and configured thresholds
Step 4
Administrator or security analyst
Investigates the evidence and takes appropriate action
Monitoring architectures vary. Some systems collect metrics using SNMP, others process logs or flow records, and packet analysis tools inspect traffic that is available to them.
02 · The process
The main stages of network monitoring
Effective monitoring requires more than installing a dashboard. Teams need useful data, sensible thresholds, context and a process for responding to findings.
Collect
Gather supported device metrics, logs, flow records or packets from approved monitoring points.
Analyze
Compare current measurements with expected behavior, baselines and relevant historical data.
Alert
Notify the right people when a configured condition or important event requires attention.
Respond
Investigate the cause, document findings and apply an appropriate operational or security response.
Example: a network link becomes overloaded
A monitoring system observes that a network interface is experiencing sustained high utilization. The administrator checks traffic patterns, recent configuration changes and whether a scheduled backup or legitimate workload explains the increase. If the traffic is unexpected, the investigation can move into security analysis.
Measurement
Interface utilization rises
Investigation
Review traffic and related events
Resolution
Address the verified cause
03 · Measurements
Important network monitoring metrics
Different measurements answer different questions. The right combination depends on the network, services and risks being monitored.
| Metric | What it tells you | Why it matters |
|---|---|---|
| Bandwidth utilization | How much link capacity is being used | Helps identify congestion or unusual traffic volume |
| Latency | Time taken for data to travel between endpoints | Helps investigate slow applications and connections |
| Packet loss | Packets that fail to reach their destination | Can indicate congestion, link issues or other faults |
| Availability | Whether a monitored device or service is reachable | Helps identify outages and service interruptions |
| Connection patterns | Observed endpoints, ports, protocols and connection rates | May help reveal unexpected communication |
| Device and system logs | Events recorded by devices, services and applications | Supports troubleshooting and security investigations |
04 · Defensive security
How network monitoring helps cybersecurity
Monitoring gives defenders visibility into activity that may otherwise be difficult to understand. Its value depends on what data is collected and how findings are investigated.
Unexpected outbound traffic
A workstation begins sending substantially more data than expected. A defender checks the destination, application, user activity and available endpoint evidence.
Repeated connection attempts
Logs show repeated attempts to connect to a service or multiple ports. The analyst checks whether the behavior is expected and whether the source is authorized.
Unexpected device communication
A device communicates with a server or external destination that is unusual for its role. The finding may justify further investigation.
Changes outside normal hours
A sensitive device or service generates events at an unusual time. The team compares them with maintenance schedules and approved activity.
VISUAL DIAGRAM 02
From unusual activity to a security decision
Monitoring helps surface evidence. Investigation determines what that evidence means.
Observed network activity
Traffic records, device metrics or system events
Monitoring rule or analysis
An unusual pattern or configured threshold is identified
Expected activity
Document the finding and adjust monitoring if appropriate
Potential security concern
Gather more evidence and follow incident-response procedures
This is a simplified workflow. Monitoring alerts may be benign, operational, security-related or inconclusive.
To understand a more specialized detection system, read Intrusion Detection Systems (IDS).
05 · Tools and technologies
Common network monitoring tools
Different tools serve different purposes. Packet analysis, network telemetry, logs and performance monitoring are complementary capabilities, not interchangeable products.
Wireshark
Wireshark lets users inspect captured packets and examine protocol details. It is useful for learning how network communication works and troubleshooting problems.
Best suited for: detailed packet inspection and protocol troubleshooting.
Zeek
Zeek is a network security monitoring platform that generates structured records about observed network activity. Analysts can use those records to investigate connections and communication patterns.
Best suited for: network activity analysis and security monitoring workflows.
Zabbix
Zabbix monitors supported infrastructure and services, collecting metrics and generating alerts based on configured conditions.
Best suited for: device health, availability, performance metrics and operational alerting.
Prometheus
Prometheus collects and stores time-series metrics from configured targets. It is commonly used for infrastructure and application monitoring with compatible exporters and alerting integrations.
Best suited for: numeric metrics, trends and alerting integrations.
Which tool should a beginner learn first?
Start with Wireshark to understand packets, protocols, source and destination addresses, and ports. Then explore device metrics and logs. Later, try a dedicated monitoring system in a lab so you can understand how individual observations become dashboards and alerts.
06 · Evidence
Understanding network logs and traffic records
Logs and flow records help explain what happened, when it happened, and which systems were involved. Their detail depends on the source and how it is configured.
Device and service logs
Routers, firewalls, servers and applications may record events such as interface changes, connection decisions, authentication failures, service errors and administrative changes.
- • Timestamp and event type
- • Device or service that generated the event
- • Relevant addresses or account identifiers
- • Action taken or result, when recorded
Network flow records
Flow records summarize observed communication. Depending on the format and configuration, they may include source and destination addresses, ports, protocol, packet counts, byte counts and timing information.
- • Which endpoints communicated
- • Which protocol or ports were involved
- • Approximate traffic volume
- • When the communication was observed
Illustrative log example
timestamp: 2026-10-12 10:15:00
device: example-firewall
source: 192.168.1.25
destination: 192.168.1.10
protocol: TCP
destination_port: 443
action: allowed
bytes: illustrative-valueThis is a fictional, simplified example—not a real device log or a universal log format. A single allowed connection does not prove that the traffic is safe or malicious.
07 · Investigation
How to investigate unusual network activity
A useful investigation starts with a specific observation and builds a timeline from multiple sources of evidence.
Define the observation
Record the event, affected device, timestamp, relevant addresses and why the activity appears unusual.
Check normal behavior
Compare the observation with known services, scheduled jobs, maintenance windows and historical activity.
Correlate other evidence
Review relevant firewall logs, endpoint events, DNS records, authentication logs and available flow information.
Document and respond
Record what the evidence supports, note uncertainty, and follow authorized incident-response procedures when needed.
A good analyst asks questions before making conclusions
- • Is this communication expected for the device?
- • Is the destination known and authorized?
- • Do other records support the same explanation?
- • Is there evidence of impact or continued suspicious activity?
- • What additional information would confirm or disprove the concern?
08 · Operational practices
Network monitoring best practices
A reliable monitoring setup should provide useful visibility without overwhelming people with noise or exposing monitoring data unnecessarily.
Know what you monitor
Maintain an inventory of important devices, services, network segments and responsible owners.
Choose useful thresholds
Use sensible alert conditions based on service requirements and observed normal behavior.
Protect management access
Use strong authentication, least privilege, secure management protocols and timely updates.
Synchronize system clocks
Consistent time settings help correlate events from firewalls, servers and monitoring sensors.
Secure logs and records
Restrict access, protect data in transit and at rest, and establish appropriate retention practices.
Test the response process
Use authorized exercises to verify that alerts reach the right people and documented procedures work.
Common questions
Network monitoring FAQs
Answers to common questions about monitoring methods, metrics and network security.
What is network monitoring?+
Network monitoring is the process of observing network devices, connections, traffic, availability and performance to understand how a network is operating and identify problems or suspicious activity.
Why is network monitoring important for cybersecurity?+
Network monitoring can help defenders identify unexpected connections, unusual traffic volumes, repeated connection failures, service disruptions and other signs that deserve investigation. It supports security operations but does not guarantee that every attack will be detected.
What is the difference between network monitoring and an IDS?+
Network monitoring is a broad practice that includes availability, performance, traffic analysis and security observation. An intrusion detection system focuses specifically on identifying potentially malicious or unauthorized activity and generating alerts.
What is SNMP used for in network monitoring?+
Simple Network Management Protocol (SNMP) allows monitoring systems to collect information from supported network devices, such as interface status, traffic counters and device health. SNMP monitoring is useful for operational visibility but is not, by itself, a complete security monitoring solution.
Can network monitoring reveal encrypted traffic?+
Monitoring can often reveal metadata such as connection endpoints, ports, timing, traffic volume and protocol information. Encryption generally protects the contents of communications, so monitoring metadata does not automatically reveal the messages or files being transferred.
Which tools can beginners use to learn network monitoring?+
Beginners can learn with Wireshark for packet analysis, Zeek for network activity logs, and Zabbix or Prometheus-based monitoring setups for supported operational metrics. Use a personal lab or a network you are explicitly authorized to monitor.
Does network monitoring automatically block attackers?+
No. Monitoring generally observes activity and reports findings. Blocking usually requires an appropriately configured firewall, intrusion prevention system, access control, or another response mechanism.
Continue learning
Explore more network security topics
Learn how monitoring, traffic filtering and threat detection work together to support a safer network.
Related network security guides
Continue your learning
Explore these related topics to build a stronger understanding of network defense.
Build your network defense knowledge
Start with network fundamentals, understand how devices communicate, and then learn how defenders observe activity and investigate potential threats.
Explore Network Security →