Network traffic monitoring and control: tools and technologies

Network traffic monitoring and control can involve several tools and approaches, depending on the level of visibility or control required. These include interface and connection monitoring, packet capture, Ethernet port mirroring, centralized device monitoring with RMS, SNMP-based network management, event and security monitoring, and traffic-control functions such as QoS, SQM, and rate limiting.

This guide covers traffic and connection monitoring, packet capture, Ethernet traffic inspection, centralized monitoring, SNMP, security and event monitoring, and traffic-control options available on Teltonika industrial devices.

Start with traffic and connection visibility

When investigating a network problem, detailed packet inspection is not always the first step. Interface statistics and active connection information can show whether traffic levels have changed, and which connections are currently active.

Teltonika RUT series routers, for example, provides real-time traffic graphs for inbound and outbound traffic on its network interfaces. Its Realtime Connections view displays active connections together with network, protocol, source and destination information, and transfer speed.

If an interface is experiencing unexpectedly high traffic, connection information can help identify the relevant endpoints and protocols. These devices also provide Traffic Logging, which can periodically transfer selected traffic-log data to an FTP server. It allows traffic information to be retained outside the device rather than viewed only in real time.

Go deeper with packet capture

If traffic statistics and connection information are not enough, packet capture provides more detailed information about network communication.

Supported Teltonika products can use TCPdump for packet capture. On compatible routers, such as RUT series, TCPdump enables detailed network traffic analysis by capturing it on a selected interface and filtering by protocol, host, port, and packet direction. The resulting capture can then be downloaded for further analysis.

Packet capture: benefits and limitations

For Ethernet networks, port mirroring provides another way to make traffic available for analysis by an external system. This feature is supported by TSW series switches, SWM series devices, and most RUT series routers. Depending on the device, incoming and outgoing packets from a selected Ethernet port can be mirrored to a monitoring port for further inspection.

This is useful when traffic needs to be inspected by a dedicated monitoring or packet-analysis system without placing that system directly in the production communication path.

Monitor distributed networks from one place

The requirements change when a network contains many remote routers, gateways, or switches. Checking individual devices manually becomes increasingly difficult as the deployment grows.

Teltonika RMS is a cloud system designed for remote monitoring and management of Teltonika products. It can gather device status information and support configuration changes even when devices do not have public IP addresses.

RMS Device Details provides network information such as mobile status, Ethernet port status, WAN information, and WAN IP address, as well as device information including uptime, CPU, RAM, storage, temperature, and modem information. It also provides access to recent RMS events, task logs, and configuration changes.

For longer-term analysis, RMS Monitoring History provides data collected by enabled monitoring templates over a selected period. Custom templates can be used to define which parameters should be monitored.

Managing a growing number of remote devices? Talk to the Teltonika team about how RMS can help structure monitoring across your deployment, identify the information worth tracking, and maintain visibility as your network expands.

Integrate with an existing network monitoring platform

Supported Teltonika devices, such as RUT series routers and TSW series switches, provide SNMP for network monitoring and administration.

Switches can expose Ethernet port information through SNMP, including port state, speed, received and transmitted bytes, and current receive and transmit rates.

For an infrastructure that already includes routers, switches, and other vendors, SNMP integrates Teltonika devices into the existing monitoring workflow.

Add security and event context

Traffic information shows network activity, but it does not necessarily explain a security-related event or a change in device state.

Event Juggler can use events and configured conditions to trigger actions. On RUT series routers, for example, an event can be used as a trigger and configured conditions can determine whether an action such as sending an email is executed.

Security monitoring can also include access and login activity. Teltonika TSW series switches security documentation includes monitoring of login attempts and access logs, with Event Juggler available for configured alerts on critical changes.

Taking control of your network traffic

Monitoring shows what is happening. Traffic-control functions determine how traffic should be handled.

For routed traffic, RUT series routers provide QoS and SQM functions. QoS can prioritize traffic based on hosts, ports, or services and limit download and upload speeds on a selected interface. SQM can limit download and upload speeds on selected interfaces.

For Ethernet networks, TSW series switches provide QoS and bandwidth-control features. Its rate-limiting functions can restrict inbound and outbound bandwidth, while QoS provides traffic prioritization and queue scheduling.

A router or gateway is relevant when traffic needs to be controlled at a routed or WAN interface. A managed Ethernet switch is more relevant when control is required within the Ethernet network.

A practical troubleshooting approach

A useful way to approach network traffic problems is to increase the level of detail only when the previous level does not provide enough information.

1. Start with traffic and connection data to identify changes in traffic levels or active endpoints.

2. Move to packet-level analysis with TCPdump when connection-level data is insufficient.

3. Use Teltonika RMS for centralized monitoring of distributed equipment infrastructure.

4. Use SNMP when Teltonika devices need to be integrated into an existing NMS.

5. Apply QoS, SQM, or rate limiting at the appropriate routed or Ethernet control point.

Choosing the right tool for the network requirement

Feature availability varies by model and firmware version. Final device selection should therefore be checked against the required interfaces, protocols, monitoring functions, and traffic control capabilities.

Need help selecting the right combination of traffic monitoring, packet inspection, centralized management, and traffic control for your network? Connect with the Teltonika team to discuss the architecture, required visibility, interfaces, and control points for your deployment.