What is the value of value of having a record of all network activity?
Today, network analysis tools are plentiful, but all rely on a sampling of data. You either analyze a sampling of data and hope to find the root cause of a problem, or you have to know just what to look for while you are analyzing the live, active traffic. Too often, you don’t know what to look for until after the traffic has already passed over your network. Having a complete record of your network traffic allows you to perform filtering, analysis and forensics to uncover the root cause of a problem. Astute organizations now understand the need to shift resources from a simple “prevention” mode to a complete detection and remediation system. After all, the worst attacks are the ones you never know about. Active network forensics levels the playing field by allowing network administrators to “see” attacks, understand their root cause, and then configure the network to prevent their recurrence. Unlike slow, simple network data capture devices that require tedious analysis of sample data
