Network Monitoring Basics: Detect Threats Before They Spread

Overview

Effective network monitoring is essential for security and operational visibility. This guide covers fundamental concepts and tools for monitoring your network infrastructure.

Who Should Use This Guide

• Network administrators managing infrastructure
• Security analysts monitoring for threats
• System administrators troubleshooting connectivity
• SOC teams building detection capabilities

Why Monitor Your Network

Requirements

System Requirements

Tools Referenced

Key Metrics to Monitor

Bandwidth and Throughput

Connection Statistics

Error Rates

Process

Step 1: Install Packet Capture Tools

Set up fundamental traffic analysis capability.

Installation:

# Debian/Ubuntu
sudo apt update
sudo apt install tcpdump wireshark nethogs iftop -y

Verification:

tcpdump --version
wireshark --version

Expected Output: Version information for each tool.

Step 2: Capture Network Traffic

Use tcpdump for command-line packet capture.

Basic Capture Commands:

# Capture traffic on interface
sudo tcpdump -i eth0 -n
 
# Capture specific port
sudo tcpdump -i eth0 port 443
 
# Capture and write to file
sudo tcpdump -i eth0 -w capture.pcap
 
# Read from capture file
tcpdump -r capture.pcap
 
# Filter by host
sudo tcpdump -i eth0 host 10.0.0.50
 
# Capture specific protocols
sudo tcpdump -i eth0 'tcp port 80 or tcp port 443'

Verification:

ls -la capture.pcap

Expected Result: Capture file created with packet data.

Step 3: Analyze Traffic with Wireshark

Use graphical analysis for deep packet inspection.

Common Display Filters:

Analysis Workflow:

1. Open capture file in Wireshark
2. Apply display filter for traffic type
3. Follow TCP streams for full conversation
4. Export suspicious traffic for further analysis

Step 4: Monitor Real-Time Bandwidth

Track bandwidth usage by process and connection.

Using iftop:

sudo iftop -i eth0

Key Display Information:

Using nethogs (per-process):

sudo nethogs eth0

Verification: Real-time display shows active connections and bandwidth.

Step 5: Deploy Suricata IDS

Install network-based intrusion detection.

Installation:

sudo apt install suricata -y

Configuration (/etc/suricata/suricata.yaml):

vars:
  address-groups:
    HOME_NET: "[10.0.0.0/8,172.16.0.0/12,192.168.0.0/16]"
    EXTERNAL_NET: "!$HOME_NET"
 
af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
 
outputs:
  - eve-log:
      enabled: yes
      filename: eve.json
      types:
        - alert
        - dns
        - http
        - tls

Update Rules:

sudo suricata-update
sudo systemctl restart suricata

Verification:

sudo systemctl status suricata
tail -f /var/log/suricata/fast.log

Expected Result: Suricata running; alerts appearing in log.

Step 6: Set Up Prometheus Monitoring

Deploy metrics collection infrastructure.

Install Node Exporter:

wget https://github.com/prometheus/node_exporter/releases/download/v1.7.0/node_exporter-1.7.0.linux-amd64.tar.gz
tar xvf node_exporter-1.7.0.linux-amd64.tar.gz
sudo mv node_exporter-1.7.0.linux-amd64/node_exporter /usr/local/bin/

Create Systemd Service (/etc/systemd/system/node_exporter.service):

[Unit]
Description=Node Exporter
After=network.target
 
[Service]
Type=simple
ExecStart=/usr/local/bin/node_exporter
Restart=always
 
[Install]
WantedBy=multi-user.target

Enable Service:

sudo systemctl daemon-reload
sudo systemctl enable --now node_exporter

Verification:

curl http://localhost:9100/metrics | head -20

Expected Result: Prometheus metrics displayed.

Step 7: Configure Alerting

Set up alerts for security-relevant events.

Prometheus Alerting Rules:

groups:
  - name: network
    rules:
      - alert: HighBandwidth
        expr: rate(node_network_receive_bytes_total[5m]) > 100000000
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: High inbound bandwidth detected
 
      - alert: ManyConnections
        expr: node_netstat_Tcp_CurrEstab > 1000
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: Unusual number of connections

Common Indicators of Compromise

Suspicious Traffic Patterns

Detection Examples

# Find potential port scans
sudo tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0' -c 1000
 
# Look for DNS tunneling (long queries)
sudo tcpdump -i eth0 port 53 -A | grep -E '.{50,}\.'
 
# Large data transfers
sudo tcpdump -i eth0 -n 'greater 10000'

Troubleshooting

Verification Checklist

Tools

• tcpdump installed and working
• Wireshark available for analysis
• Suricata IDS deployed
• Prometheus/Grafana configured

Configuration

• SPAN/mirror port configured (if available)
• IDS rules updated
• Alerting rules defined
• Dashboards created

Operations

• Baseline traffic documented
• Log retention configured
• Alert escalation defined
• Regular review scheduled

Best Practices

References

• Suricata Documentation
• Wireshark User Guide
• Prometheus Documentation

Last Updated: January 2026