Network Monitoring Basics
You cannot defend what you cannot see, and network monitoring is how you see. It continuously collects data about network activity — flows, connections, protocols, device health — to give both operations and security a live picture of what is happening. For defense, that visibility is the raw material of detection: without it, an attacker can move through your network entirely unobserved.
What does monitoring capture?#
A range of data, from summary to detail:
| Data | Reveals |
|---|---|
| Flow data (NetFlow/IPFIX) | Who talks to whom, how much — at scale |
| Full packet capture | Detailed content for deep analysis |
| Device/health metrics | Availability and performance |
| Connection logs | Session-level activity |
This feeds traffic analysis, IDS/IPS, and a SIEM for correlation with other sources.
Why baselining is essential#
Monitoring only becomes detection when you can tell normal from abnormal. Establishing a baseline — what typical traffic, volumes, and connection patterns look like — lets you flag the meaningful deviation: the workstation that suddenly beacons outbound, the database that starts transferring gigabytes, the internal host talking to systems it never touches. Without a baseline, anomalies hide in plain sight.
Network monitoring provides the visibility detection depends on. More at the Defense & Hardening hub.
Frequently asked questions#
What is network monitoring?
Network monitoring is the continuous collection and analysis of data about network activity — traffic flows, device health, connections, and protocols — to maintain visibility for both operations and security. For security specifically, it provides the data to detect anomalies, investigate incidents, and understand what is actually happening across the network.
Why is baselining normal behavior important?
Because you can only recognize abnormal if you know what normal looks like. A baseline of typical traffic patterns, volumes, and connections lets monitoring flag meaningful deviations — a server suddenly connecting outbound, an unusual data transfer — instead of drowning in raw activity. Without a baseline, everything looks either normal or suspicious.