How to Use Network Traffic Analysis Tools to Improve Troubleshooting and System Functionality? A regional healthcare organization improved its network traffic analysis and monitoring performance by upgrading existing network switches and deploying traffic capture probes at remote locations.
Puget Sound Blood Center (PSBC), located in Washington, has been using Stealthwatch for several years. Stealthwatch, a network traffic monitoring tool produced by Lancope, can collect and analyze packet, NetFlow, and sFlow data to detect network anomalies and monitor network performance. Vickie Dahl, Network Services Manager at PSBC, said that initially, the lack of remote probe deployment, combined with a legacy Cisco switch infrastructure that did not support NetFlow, meant Stealthwatch provided very limited visibility into their enterprise network, restricting the ability to collect IP traffic information.
“The system mostly collected data in passive mode, and that was after problems had already occurred,” Dahl said. “It lacked real-time monitoring capabilities and couldn’t drill down to the user-ID level as it can now.”
After deploying new HP ProCurve switches, PSBC’s enterprise network gained much better visibility. The HP ProCurve switches support sFlow monitoring, and with the increased deployment of probes at remote locations, timely data collection was no longer an issue.
“Now that we have updated all our equipment, we are running sFlow on HP switches and NetFlow on Cisco routers,” Dahl said. “This gives us an excellent overview of how our enterprise network is operating.”
When problems arise, whether network-related or not, the network traffic analysis tool allows the network team to intervene quickly, which has significantly improved the blood center’s troubleshooting capabilities.
“If a user reports slow network speeds, an inaccessible website, or application failures, we can use Stealthwatch to help us drill down into the client’s computer and examine the operational status of each connection or program,” Dahl said. “Whenever an application is running slowly or has any other issue, everyone tends to blame the network. Now, we can display every step and connection a user makes in real time and prove that it is not a network connectivity or bandwidth problem.”
Peggy Dunn, IT Director at the blood center, said the network traffic analysis tool allows their organization to quickly rule out the network as the root cause of problems.
“Network services can eliminate the network as the issue,” Dunn said. “Then we escalate to the application or database owners. Typically, it goes to the database administrators, who use their own analysis tools to see which database everyone is accessing. If it’s not a database problem, then we have the programmers look at the application to see if that is the true root cause of the issue.”
Dahl said Stealthwatch’s dashboard view allows her team to monitor network events in real time. If a PC on the blood center’s network becomes infected with malware, administrators can detect the anomalous operational behavior based on the infection and quickly identify the compromised device for the next steps in remediation.
Having flow-based network monitoring capabilities is critical, Dunn said, because their organization not only collects blood but also supplies it to other healthcare providers. Puget Sound Blood Center’s patient management application and blood establishment computer system process patient information and track blood and tissue donations across 185 hospitals in the Northwestern United States. Because the system directly handles patient information among these numerous hospitals, network reliability and uptime are paramount, she said.
“We cannot afford system downtime under any circumstances,” Dunn said. “Because we serve patients, not just a single hospital, it is vital to have a product that provides the capability to monitor our network systems permanently and effectively.”
銆怑ditor’s Picks銆?/strong>