I am setting up a trial of Argus at my company as a diagnostic tool. We have a collector box attached to a monitoring port on our switch, and the initial plan is to redirect ports with unusual traffic to the collector and then analyze it to get troubleshooting info. I need to sell this before I can pitch a more consistent monitoring solution, which I know is the real strength of this type of application.
The initial reports will be all on the command line, so reducing the information presented to a manageable level is key.
My question is this: From both a security and troubleshooting point of view, what information would be most valuable? What reports should I have preconfigured?
I have already thought of: Listing of address currently talking on the port (our network map is horrible), Protocol distribution, and current flows for a specific IP.
Maybe one on packet loss or broken connections? (not sure if I can do that last one)
Also if you think this should be a community wiki just leave a comment and I'll swap it over.
Thanks, I wish I had the background to answer this, but I'm working hard to get there.