Network Protocol Analyzer with PRTG

A protocol analyzer (also protocol analysis tool, traffic analyzer, packet analyzer, or packet analysis tool) is software that you can use to record and analyze data traffic in a network. In concrete terms, this means that the network traffic is broken down according to various parameters. The data flows are then displayed in diagrams and tables for analysis.

PRTG includes protocol analysis functionalities to track and analyze using packet sniffing, as well as different flow protocols. Network traffic is categorized by connection, IP address, and by protocol.

In the context of flow monitoring, the term “flow” refers to the flow of data packets between two endpoints, such as devices or applications. Recording the data flow is mostly done by exporting the flow data of a device (for example a router, firewall, or switch). In addition, a data collector is required. Its task is to log the data so that it can be analyzed later.

PRTG offers several preconfigured sensors for collecting, analyzing, and monitoring flow data.

PRTG incorporates flow monitoring technologies like NetFlow, sFlow, and jFlow in its protocol analysis toolkit. This allows for the in-depth examination of network traffic patterns, helping to identify the types of traffic and protocols being used, as well as pinpointing sources of high bandwidth consumption. Flow monitoring is essential for understanding how data moves through your network and for identifying potential security threats or inefficiencies.

Yes, while PRTG respects encryption by not decrypting content, it analyzes encrypted traffic flow data to provide insights on bandwidth usage, communication patterns, and source/destination metrics. This level of analysis is critical for managing network performance and security, even when the traffic content remains private.

PRTG offers extensive customization options for protocol and flow analysis, including the ability to set specific sensors and filters for monitoring particular protocols or traffic types. This flexibility ensures that network administrators can focus on the traffic that matters most to their organization's security and performance goals.

Leveraging protocol analysis and flow data, PRTG can detect anomalies by comparing current traffic patterns against historical baselines. This capability allows for the early detection of unusual activities, such as spikes in bandwidth usage or the emergence of unfamiliar protocols, which could indicate security concerns or network issues.

Indeed, PRTG's flow monitoring capabilities extend to both internal network traffic and external Internet-bound traffic. This ensures comprehensive visibility into all data flows, enabling effective management and security oversight across the entire network infrastructure.

In PRTG, “sensors” are the basic monitoring elements. One sensor usually monitors one measured value in your network, for example the traffic of a switch port, the CPU load of a server, or the free space on a disk drive. On average, you need about 5-10 sensors per device or one sensor per switch port.