They offer an interface by means of which the traffic analyst will be able to visualize and manipulate the decoded packets.

They identify the protocol associated with each packet and carry out the decoding of the packet headers according to the corresponding protocols.

For example, you start capturing when you observe packets with a specific destination MAC address.

They allow undertaking a data capture when a given condition arises.

They allow to define parameters that will govern the capture of packages for example, they allow us to capture only the packages that have the same destination IP address, the same source MAC address, the same protocol, etc.

In this article we will use the term package to refer to both frames and packages.

Capturing and storing layer 2 frames and packages associated with higher levels.

In this article we invite you to review how a traffic analyzer works, and how you can make the captures and then plan a series of strategies for the following steps. The answer is: “Now it’s time to do traffic analysis.” And we realize that analyzers make analysis possible, but we must do the analysis. Since an analyzer can capture an enormous quantity of packets, it can show us their headers, it can offer us facilities, it can make multiple filters, it can show us graphs about the most referenced elements, statistics about total traffic, quantity of errors and so on.Īt that point it is logical to ask ourselves: “And now what should I do?”

Now, many times we see network analysts who after installing the tool feel overwhelmed by the amount of information it offers them. When we are faced with a performance problem related to those responsible for the applications and those responsible for the network platform, we usually think about how useful it would be to have a traffic analyzer that clarifies the real origin of the problem.

Traffic Analyzers: What do they do and how are they used?

Trafficanalysis