The blind side: What network monitoring tools don't see

Survey results show that more than four-fifths of network and security operations professionals polled lack sufficient visibility into network traffic.

Network/Systems Management Alert By Denise Dubie, Network World
January 25, 2010 08:54 AM ET

Industry analysis by Beth Schultz, plus the latest news headlines.

Less than 20% of network and security operations professionals believe they have achieved sufficient monitoring coverage, according to recent survey results, meaning more than 80% don’t feel they are adequately able to monitor network segments, application performance or IT service delivery.

5 must-have management technologies for 2010

Market research firm Enterprise Management Associates (EMA) polled network and security operations professionals in September 2009 to learn more about network monitoring practices and gain insight into how companies could optimize their approach to monitoring. The resulting report, called “Monitoring Optimization 2010” and commissioned by network test and measurement vendor Anue Systems, revealed that several key challenges prevent about four-fifths of those polled from gaining the visibility into network traffic required to optimize performance and availability.

“While companies have invested heavily in monitoring tools, the results of the survey indicate a variety of challenges in establishing and optimizing network traffic access, whether for security monitoring or network monitoring and troubleshooting,” reads the EMA report. “These issues translate into operational risks that will inevitably grow over time.”

Related Content

For instance, 43% of respondents indicated a shortage of and an inability to share span ports or taps for monitoring tools. Two-thirds said they simply lacked sufficient monitoring tools and tool budgets, while nearly three-fourths reported that the monitoring tools are deployed sub-optimally – meaning 47% are under-utilized and 25% drop packets due to over-subscription. And 65% of respondents face significant monitoring challenges when migrating to 10Gigabit Ethernet, including the inability to monitor 10G traffic with existing 1G tools, the report states.

EMA research director Jim Frey authored the study that points to three key reasons network and security operations professionals might be “falling short in monitoring their network segments.” The lack of network access reported by 43% results “in part from a lack of access to network segments of interest and also in part due to the lack of ability to share what access points do exist,” according to the report. The sub-optimal monitoring tool deployment noted by two-thirds of respondents has two causes: the first being a lack of tools and budget; and the second involved tools not being used to their fullest potential and/or overloaded tools dropping packets. And last, IT professionals polled pointed to a lack of staff or specific skills on staff, which leads to insufficient monitoring.

“Nearly a quarter of our research group (24%) reported their either lack the staff to keep up with monitoring tasks or the training within existing staff to keep up with administration or interpretation,” the report reads. “This situation results from both current and ongoing budgetary pressures as well as a trend (identified by 62%) of staff moving toward more generalist roles, reducing the availability of technical specialists.”

Schultz is a longtime IT journalist. You can email her or find her here.