The ideal way for Network Sniffing

Network sniffing is a form of data packet analysis supporting real-time network monitoring. Network sniffing is used to diagnose network problems and analyze the overall network and application activity. With packet-level insights, admins can pinpoint slowdowns, categorize and assess traffic and identify security risks. 

Sniffing is also popular with hackers, who use it to intercept data and spy on network activity illegally. Yet, with your company's approval, many new insights can be discovered by utilizing this unique method.

Network sniffing software is used to monitor system and application performance and effectiveness, analyze traffic patterns or types, detect security issues, or most importantly, extract valuable information without causing any traffic overhead. So this method is not only for troubleshooting, but can be utilized to for example gather insights of the internal traffic between proprietary systems.  Here lays the new power of such a data collection approach.

How does it work? 

To understand how network sniffing works, you need to realize that there can be multiple solutions for a particular problem. So let’s investigate potential issues and solutions based on network sniffing.

The problem

System A talks to B, and B answers to A. This communication is done over a network connection. Now we want to know what they are talking about, in order to feed another system, such as a data warehouse, with this data that would otherwise never see the light of the day, figuratively.

Failed solutions

What was first tried is changing the chain of communication from A -> B to A -> C -> B. You put something in between A and B, so this new system, C, sees what A and B are talking about. This is called a man-in-the-middle approach. A disadvantage of this approach is that when C fails or crashes, it blocks the path between A and B. This would mean systems A and B cannot talk to each other anymore due to this external injection of a third party. A second disadvantage is that there is now an extra step between A and B, causing some performance degradation and delay. 

A second solution is to add C to system B. The chain of communication between the systems would then look like this: A-> (C)B. This would mean changing B to send the topics that A and B are talking about to another system C. The problem with this is that you need to modify the original system B to accommodate (C)B. But this can be a critical/old/legacy system that we either can’t or do not want to change because it is working now.  

The ideal solution

What the Datumize Data Collector (DDC) relies on is mirroring of the existing network traffic: parties A and B keep on talking as usual, but the traffic from that network segment is replicated in its entirety and made available to a third party C. And by understanding the underlying data transmission protocols, the DDC is able to reconstruct the conversation, extract the bits needed, and send them to the data warehouse or other preferred system. This has proven to be the best solution with no negative effects on the existing systems or data transmissions.

There is no need to change system A or B, and there are no delays in the communication process. Because we add C via a separate data line,  A and B are still communicating with each other as they did before without being interfered with. Mirroring traffic is a feature that is available on most industrial data switches, and sometimes just allowing access to the same network can be enough - no special mirroring hardware is needed. 

Benefits of data sniffing

Data sniffing helps to discover communications that you didn't know were there. Often systems were built with only a certain requirements for data sets: the data that was collected might be restricted by storage capacity or processing speed, but in the decade after such an installation was made, both capacity and speed have now improved more than tenfold.

Changing the original systems may not be cost-beneficial, but more fine-grained data exists in the network.  DDC can be used to dig that out.

The actual applications are only limited by imagination: existing systems are diverse and used for all kinds of purposes, and being able to extract information in a unobtrusive manner brings a totally new dimension to your business. We at Datumize are happy to show you more use cases in which our DDC might be applicable to your business.