Network security monitoring with PRTG

• Malware: Malicious software like viruses, worms, and ransomware that can damage or disrupt network operations.
• Phishing: Social engineering attacks where attackers trick users into providing sensitive information, often through deceptive emails or websites.
• Man-in-the-Middle (MitM) attacks: When an attacker intercepts and potentially alters communications between two parties without their knowledge.
• Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks: Attacks that overwhelm a network with traffic, rendering it unusable.

Common network security measures include:

• Firewalls: Devices or software that monitor and control incoming and outgoing network traffic based on predetermined security rules.
• Intrusion Detection and Prevention Systems (IDPS): Tools that monitor network traffic for suspicious activity and take action to prevent potential breaches.
• Virtual Private Networks (VPNs): Secure connections over the internet that encrypt data, ensuring that information sent and received is protected from interception.
• Antivirus and Anti-malware: Software that detects, prevents, and removes malicious software from the network and devices connected to it.
• Encryption: The process of converting data into a coded format that is unreadable to unauthorized users, ensuring that only those with the correct decryption key can access the original data.
• Access control: Policies and technologies that restrict who can access certain parts of the network and what actions they can perform. This includes user authentication mechanisms like passwords, biometrics, and multi-factor authentication.
• Network segmentation: Dividing a network into smaller segments to limit access to sensitive data and resources, thereby reducing the potential impact of a security breach.
• Security Information and Event Management (SIEM): Systems that collect, analyze, and report on security-related data from across the network to detect and respond to threats in real-time.

In PRTG, “sensors” are the basic monitoring elements. One sensor usually monitors one measured value in your network, for example the traffic of a switch port, the CPU load of a server, or the free space on a disk drive.

On average, you need about 5-10 sensors per device or one sensor per switch port.