Skip to content
Infrastructure

Traffic Analysis

Overview

Section titled “Overview”

Network traffic analysis is the process of capturing, examining, and interpreting network traffic to Troubleshoot problems, detect anomalies, optimize performance, and investigate security incidents. This document covers packet capture methodology, advanced tcpdump and Wireshark usage, network flow Analysis (NetFlow/sFlow/IPFIX), bandwidth monitoring, and incident response workflows.

The fundamental skill is being able to answer the question: “what is actually on the wire?” — Independently of what you expect to be there.

Packet Capture Methodology

Section titled “Packet Capture Methodology”

Where to Capture

Section titled “Where to Capture”

Choosing the right capture point is the first and most important decision. The wrong capture point Yields misleading or useless data.

SPAN Port (Switched Port Analyzer):

A SPAN port mirrors traffic from one or more source ports to a destination port where the capture Device is connected. Available on most managed switches.

# Cisco IOS SPAN configuration
monitor session 1 source interface Gi0/1 both
monitor session 1 destination interface Gi0/24

Advantages: no hardware cost, works on any switch. Disadvantages: may drop packets under heavy load (ASIC limitations), does not capture errors on the source port, may not mirror all VLAN tags Correctly.

Network TAP (Test Access Point):

A hardware device inserted inline between two network devices. TAPs provide a passive copy of all Traffic (including errors and malformed frames) to the capture device.

[Switch] --- [TAP] --- [Router]
                |
           [Capture Device]

Advantages: captures everything including errors, no impact on the monitored link, full-duplex Monitoring. Disadvantages: hardware cost, requires physical access to insert, introduces a potential Point of failure.

Inline Capture:

Capture traffic at the endpoint itself (on the server, VM, or container). Uses libpcap to capture Packets as they enter and leave the network interface.

Advantages: captures the endpoint”s perspective (including locally-generated traffic), no additional Hardware. Disadvantages: endpoint CPU overhead, may not capture traffic that the endpoint’s OS drops Before libpcap sees it.

Capture Point Selection Guide

Section titled “Capture Point Selection Guide”
ScenarioBest Capture Point
Troubleshoot server connectivityOn the server (tcpdump)
Full link visibilityTAP (if available) or SPAN
Packet loss investigationTAP (captures errors)
Multi-point analysisSPAN + server capture, correlated
Encrypted traffic analysisOn the endpoint (before encryption / after decryption)
Container networkingOn the host’s veth interface or inside the container