When to Use Metadata vs. Packets in Network and Security Triage
A traffic light camera flash offers a subtle reminder that each available data source plays a distinct role in network monitoring and investigations. While the camera timestamp and vehicle license plate number can deliver identifying information in just a few bytes, videos shot from multiple angles simultaneously capture every detail when a driver ventures into the intersection too late.
In a similar way, metadata and packets serve different but complementary roles in supporting today’s network and security investigations. While metadata helps teams identify and prioritize issues quickly, packets provide unabridged forensic evidence when a deeper level of investigation is called for.
It Starts with Metadata
The concise “data about data” known as network metadata includes information like IP addresses, port numbers, time stamps, protocol types, and packet counts that can be used to quickly detect anomalies, bottlenecks, and other unusual network behaviors. Among the most valuable metadata sources are the packet headers occupying just 2-5% of the total packet volume yet provide a bounty of unencrypted clues.
Readily available metadata combined with advanced machine learning algorithms establish effective front-line visibility for both NetOps and SecOps teams, as they seek to assess and resolve issues quickly.
Flow and Telemetry Provide Context
Flow and telemetry data bring additional context to shared or customized NetSecOps workflows, allowing teams to visualize how an entire communication is behaving over time. Enriched flow records fortify traditional flow data, using telemetry sources like system logs, DNS queries, and Transmission Control Protocol (TCP) session statistics to form a more comprehensive record. This additional context allows network and security teams to bolster their understanding of infrastructure, cloud, and user behaviors while detecting suspicious activities more effectively.
Packets for Forensic Evidence
A 360-degree video of a red-light offender might seldom be needed, but this type of indisputable evidence mirrors the role of full-packet capture in network performance and security investigations. Packet data is sometimes referred to as the ultimate source of network truth, since it provides a raw, unfiltered, and unbiased record of actual traffic. This forensic evidence becomes invaluable when additional validation is required to reconstruct incidents, resolve disputes, or provide a definitive root cause.
The back-in-time analysis capabilities afforded by packet capture also support digital resilience and compliance, as regulatory requirements for post-incident review and response continue to expand. The availability of on-demand forensic data accelerates mean time to repair (MTTR) by allowing anomalies to be fully analyzed and diagnosed without waiting for them to re-occur and supports End-User Experience (EUE) scoring to quickly assess the relevance of each domain when diagnosing a performance or security issue.
The Triage Sequence in Action
While the basic steps remain the same, the role of each data source and software solution will vary depending on the situation. The key is to match the evidence to the investigation need, while ensuring conclusions and solutions are both fast and reliable. Common scenarios help to extol the virtues of this logical approach:
- Who, what, where, and how
Basic metadata, including an IP address and login time, might indicate that an employee authenticated to internal systems outside of business hours, with flow data revealing the total session time and amount of transferred data. To investigate the incident further, forensic evidence (packet data) is analyzed from the suspect IP and time, revealing proprietary information within transferred files. A methodical drill-down from metadata to flow to forensic data delivers this conclusive evidence while validating the initial metadata-based suspicions.
- Forensic evidence yields a surprising answer
A sudden increase in packet loss, initially detected through network metadata, might appear to be normal network congestion, based on interface counters and flow data. When the root cause of the issue is not apparent based on an analysis of the available metadata, telemetry, and flow, forensic evidence is reviewed. Information from captured packets shows that a misconfigured device was injecting spoofed TCP reset packets into active sessions, with potentially serious network security implications.
- Multi-purpose metadata
An issue like unusually slow cloud-hosted applications during specific hours might be fully investigated and validated using metadata alone. For example, metadata can reveal unusual metrics on retransmission rates and round-trip times coinciding with measured packet loss on a WAN circuit, indicating that scheduled backup traffic is saturating this circuit. With the obvious conclusion validated through a simple rescheduling of backup jobs, a review of forensic data is deemed unnecessary.
VIAVI Observer Apex Bridges the Gap
Start with metadata for clarity, then pivot to forensic evidence for proof.
This basic premise makes Observer Apex the ideal operational and intelligence layer, fostering shared network visibility and unprecedented triage efficiency. The flexibility of the modular Observer Platform puts forensic evidence and threat intelligence within easy reach when a deeper level of insight and evidence is needed. Customizable dashboards and efficient workflows support fast problem identification and resolution for NetOps and SecOps teams. Observer provides the flexibility organizations need to match the evidence to the investigation.
