Rawpixel - Fotolia
The 21st-century enterprise that was already highly distributed and virtual became even more so last year when the COVID-19 pandemic triggered the global shift to remote work and distance learning. The fundamental way employees and students connected to one another changed overnight, generating profound impacts. Technical glitches disrupted operations and exposed security vulnerabilities.
In organizations where the bumps were more pronounced, IT quickly learned that performance, stability and security depended on visibility across the network. And that visibility had to extend beyond the four walls of the traditional office to wherever the traffic might flow, including headquarters, on a third-party cloud or the end user's home network.
Enter cloud-based network monitoring tools, which expose the activity across a distributed network. Because they are cloud-delivered, they can be deployed quickly and managed easily. Cloud-based monitoring not only delivers real-time network health status information, but it also logs historical performance, providing statistics IT can use for proactive optimization and forensic studies. IT is prioritizing investments in cloud-based network monitoring to optimize performance and identify anomalies indicative of threats.
Traffic insights key to monitoring
The COVID-19 pandemic brought home the need to illuminate network activity, particularly as cyberattacks escalate. Ransomware attacks, for example, rose 20% in 2020, according to IBM's X-Force team. Data theft overall more than doubled between 2019 and 2020.
Network monitoring relies on a variety of approaches to track traffic patterns. Passive collection uses existing protocols like NetFlow and sFlow and log files to collect network traffic data. Synthetic monitoring generates test traffic automatically on a regular basis, or on demand using software agents. Synthetic monitoring includes traceroute tests as well as more dynamic variations to simulate real activity on the production network.
Polling is another technique, where performance data is collected from network devices via Simple Network Management Protocol or some other method and then sent back to the monitoring provider, which analyzes the results.
Packet inspection provides a way to parse and analyze packets captured from the network or from switch ports. Deep packet inspection provides an even more detailed picture of performance, capturing packets in transit in real time and then mapping them against a set of libraries characterizing different applications.
Traditional network monitoring focused exclusively on data collection within the firewall, but tools such as synthetic network path tracking gave IT the ability to monitor activity across the entire environment.
Advanced tracking brings new capabilities
Effective cloud-based network monitoring doesn't stop at the wire. It is also important to monitor the endpoint via software-based agents that capture stats from end users' machines. This allows companies to gain a perspective of their entire environment, and it is essential when determining if a performance issue is due to a problem on the network or isolated to the endpoint.
As with other areas in IT management, AI and analytics are starting to play a greater role in both real-time diagnostics and predictive maintenance. While some IT administrators question the maturity of AI and analytics, these tools are emerging as viable options for anomaly detection via machine learning, smart log parsing and correlation.
Ultimately, AI and analytics could be used for real-time diagnostics and longer-term trend analysis to enable IT to adjust components proactively before infrastructure problems occur. AI is likely to usher in a new generation of cloud-based network monitoring use cases in the years to come.