I am setting up a trial of Argus at my company as a diagnostic tool. We have a collector box attached to a monitoring port on our switch, and the initial plan is to redirect ports with unusual traffic to the collector and then analyze it to get troubleshooting info.
I need to sell this before I can pitch a more consistent monitoring solution, which I know is the real strength of this type of application.
The initial reports will be all on the command line, so reducing the information presented to a manageable level is key.
My question is this: From both a security and troubleshooting point of view, what information would be most valuable? What reports should I have preconfigured?
I have already thought of:
- Listing of address currently talking on the port (our network map is horrible)
- Protocol distribution,
- current flows for a specific IP address
Maybe one on packet loss or broken connections? (not sure if I can do that last one)
Thanks, I wish I had the background to answer this, but I'm working hard to get there.