Network World — While simple in concept, network baselining is often misunderstood.

Baselining involves recording network traffic and performance, saving it for future reference and/or reviewing it to see traffic patterns. Once baselines are saved, they can be used as a benchmark with which to compare other traffic patterns.

The technique provides the network administrator insight into expected behavior on the network and subsequently, the ability to notice changes. People often think of expected behavior as always being good traffic, meaning that expected behavior of a network reflects when everything is running perfectly. This is incorrect. Think of expected behavior as known vs. unknown traffic.

By understanding the behavior of a network and what has happened historically, one can begin to solve problems that arise. Baselining makes it easier to identify network attacks (internal or external) and even the people causing problems (staffers downloading movies at work, for example). Without a basis of comparison, how do you determine the difference between good and bad traffic?

But the reality is less than 5% of administrators make a practice of baselining, for reasons such as "we don't have the time to do baselines" or "things change too much to do baselines" or "I'm not going to hire a person or multiple people to keep baselines organized." In these tough economic times, such concerns need to be exposed for what they are: misconceptions.

Baselining is not a time sink -- it's actually quite the opposite. And consider the economics of foregoing baselining. Change on a network can cost from thousands to millions of dollars. For example, adding bandwidth to a network with multiple sites and WAN links to a thousand or more stores might increase costs by US$500 to $1,000 per site. It is imperative that organizations size their networks based on legitimate traffic before adding such significant recurring costs.

So, how should you approach baselining? While theoretically there could be thousands of baselines, the key to success is deciding what baselines are important to the organization.

There are many macro-level baselines to consider, such as how much bandwidth is going out to the Internet and how much bandwidth is in the core. And then there are many more granular views: How many people are talking to a particular network? What protocols are going across the network? How much bandwidth does a particular application use in general? What is latency on the network for a particular application? The list goes on and on.

Consider this basic list of baselines that everyone should start out with:

Continue Reading