Overview

You cannot protect what you cannot see. Network monitoring provides visibility into traffic patterns, device health, and potential security incidents across your entire infrastructure.

Step 1: Choose and Deploy Monitoring Tools

Select the right tools for your network size and budget.

1

Free Monitoring Tools

PRTG Free: Up to 100 sensors, excellent web dashboard, email alerts, great starting point
Wireshark: Deep packet capture and protocol analysis for troubleshooting specific issues
Nagios Core: Open source, extremely powerful but requires Linux and configuration effort
ntopng: Real-time network traffic analysis with flow visibility
GlassWire: Simple visual firewall and monitor for individual Windows PCs
LibreNMS: Full-featured open source monitoring with auto-discovery

2

Set Up Basic Monitoring

Install monitoring software on a dedicated PC or virtual machine
Add your core devices: router, firewall, switches, servers, access points
Configure SNMP v3 (encrypted) on all network devices for data collection
Set up ping monitoring for all critical devices and services
Configure bandwidth monitoring on WAN link and inter-VLAN connections
Monitor CPU, memory, and disk usage on all servers
Set up uptime monitoring for critical services: email, file shares, databases

3

Network Flow Analysis

Enable NetFlow, sFlow, or IPFIX on your router/firewall
Flow data shows WHO is talking to WHOM and HOW MUCH data is transferred
Identify top bandwidth consumers by device and application
Detect unusual traffic patterns that may indicate compromise
Use flow data to plan bandwidth upgrades based on actual usage
Free flow analysers: ntopng, Scrutinizer (limited free), PRTG

Step 2: Configure Alerts and Thresholds

Get notified about problems automatically before users complain.

1

Essential Alerts

Bandwidth utilisation exceeding 80% of capacity (approaching saturation)
Any monitored device going offline (switch, server, access point)
Server CPU above 90% for more than 5 minutes (performance issue)
Disk space below 10% free on any server (impending failure)
WAN link packet loss above 1% (internet quality degradation)
Failed login attempts exceeding threshold (potential brute force)

2

Alert Configuration

Set up email notifications for all critical alerts
Configure SMS/push notifications for after-hours critical events
Use escalation: alert IT admin first, then manager if unresolved in 30 minutes
Avoid alert fatigue, only alert on truly actionable conditions
Group related alerts to prevent notification storms during outages
Create an on-call rotation if you have multiple IT staff

Step 3: Traffic Analysis and Threat Detection

Identify suspicious activity and security threats.

1

What to Look For

Unusual data transfers to external IP addresses (potential data exfiltration)
Network traffic at unusual hours: 2-5am activity on office workstations
Devices communicating with known malicious IP addresses or domains
Excessive DNS queries from a single device (may indicate malware beaconing)
Large internal data transfers between unexpected devices (lateral movement)
New devices appearing on the network that nobody authorised
Port scanning activity: sequential connection attempts across many ports

Pro Tip:

Establish a baseline of normal network activity first. Monitor for 2-4 weeks before setting anomaly alerts. Without a baseline, everything looks unusual and you will drown in false positives.

2

Regular Review Process

Review network dashboards daily for anomalies (5-10 minute check)
Generate weekly traffic reports comparing to previous weeks
Investigate any devices with significantly changed traffic patterns
Cross-reference monitoring alerts with security logs
Review top external destinations monthly, investigate unfamiliar ones
Document all investigated anomalies, even false positives, for pattern tracking

3

Responding to Anomalies

Isolate suspicious devices from the network pending investigation
Capture packet data (Wireshark) before the evidence disappears
Check the device for malware using endpoint protection
Review user activity logs on the affected device
If compromise is confirmed, follow your incident response plan
Report confirmed security incidents to management and document thoroughly

Overview

Step 1: Choose and Deploy Monitoring Tools

Free Monitoring Tools

Set Up Basic Monitoring

Network Flow Analysis

Step 2: Configure Alerts and Thresholds

Essential Alerts

Alert Configuration

Step 3: Traffic Analysis and Threat Detection

What to Look For

Regular Review Process

Responding to Anomalies

Need Professional Help?

Related Guides

How to Design a Secure Business Network Layout

How to Implement Firewall Rules for Office Security

Professional IT Support