A comparison of system monitoring methods, passive network monitoring and kernel instrumentation

Abstract

This paper presents the comparison of two methods of system monitoring, passive network monitoring and kernel instrumentation. The comparison is made on the basis of passive network monitoring being used as a replacement for kernel instrumentation in some situations. Despite the fact that the passive network monitoring technique is shown to perform poorly as a direct replacement for kernel instrumentation, this paper indicates the areas where passive network monitoring could be used to the greatest advantage and presents methods by which the discrepancies between results of the two techniques could be minimised.