Network Monitoring/Ten Best Practices

Ten best practices for network monitoring: the short list: 1. Establish baseline behavior 2. Perform network inventory 3. Avoid network alert sawtoothing/flapping 4. Don't filter your email alerts 5. Monitor deltas 6. Provide details 7. Escalation 8. Parent-Child 9. Event Correlation 10. View traffic from application endpoint

Establish baseline behavior

Establishing a network baseline is important to establishing a sense of how the network performs normally. (Note that, to this end, Bro can be used for network baselining, even though it is designed as an intrusion detection system, not as a network monitoring tool.)

Perform network inventory

Keep an inventory of devices on the network:

• Network devices
• Ports
• Interfaces being used for network connections
• Network hardware (links, switches, controllers, power supplies)
• Servers
• Virtual machines
• SAN devices

If you don't know what's on your network, you can't monitor it very well!

Avoid network alert sawtoothing

Alert sawtoothing is where an element's numerical value hovers right around the threshold, causing the alert to be triggered multiple times. This is a sign the threshold needs to be changed (higher if false alarm, lower if "too late").