Listening Without Speaking
Passive monitoring takes the opposite approach: instead of generating test traffic, it observes the real traffic already flowing through the network. No new packets are injected. A copy of every packet is made and analyzed.
Think of it like a court stenographer. They don't participate in the trial — they sit quietly and record everything that is said. Later, you can review the transcript to understand exactly what happened and when.
The primary mechanism is a network tap or a SPAN port (also called a mirror port) on a switch. The switch is configured to copy every packet on a given interface to a dedicated monitoring port, where a capture device records it. In cloud environments, the equivalent is VPC Flow Logs (AWS, GCP, Azure) or Traffic Mirroring (AWS VPC Traffic Mirroring), which capture packet headers or full payloads and write them to storage.
Tools and What They Reveal
| Tool | Scope | Use Case |
|---|---|---|
tcpdump |
Single host, CLI | Quick captures, scripted analysis |
| Wireshark | Single host, GUI | Deep protocol analysis, debugging |
| eBPF probes | Kernel-level, in-process | Low-overhead production monitoring |
| VPC Flow Logs | Cloud VPC | Who talked to whom, bytes transferred |
| NetFlow / sFlow | Router/switch export | Bandwidth accounting, top talkers |
tcpdump can capture all traffic on an interface to a file for later analysis, or narrow the capture to a specific host and port. Reading a saved capture back can filter for specific signals — TCP RST packets (connection resets), or, using tshark, a count of TCP retransmissions.
What Passive Monitoring Reveals That Active Cannot
Passive monitoring is often called the "source of truth" because it shows you exactly what happened on the wire, not what you hoped would happen:
- TCP Retransmissions: The sender didn't receive an ACK and resent data — a direct indicator of packet loss.
- TCP Resets (RST): A connection was abruptly terminated. This could be a firewall rule, a crashed application, or a load balancer timeout.
- SSL/TLS Handshake Failures: The client and server couldn't agree on a cipher suite, or a certificate was rejected.
- DNS Resolution Delays: You can see exactly how long DNS lookup took before the TCP connection even started.
- Bandwidth Hogs: Which source IP is consuming 80% of your uplink right now.
The core trade-off: Full packet capture at 10Gbps generates roughly 75TB of data per day. Storing and indexing that is expensive. Most production systems use a tiered approach — capture only packet headers (not payloads) for flow analysis, and trigger full payload capture only when anomalies are detected.