passive monitoring

{{One source|date=November 2015}}

Passive monitoring is a technique used to capture traffic from a network by copying traffic, often from a span port or mirror port or via a network tap. It can be used in application performance management for performance trending and predictive analysis.{{cite web |url=http://www.apmdigest.com/the-anatomy-of-apm-4-foundational-elements-to-a-successful-strategy |title=The Anatomy of APM - 4 Foundational Elements to a Successful Strategy |date=4 April 2012 |publisher=APM Digest }} Passive monitoring is also used in web performance optimization in the form of real user monitoring.{{cite web | url=https://www.catchpoint.com/blog/website-availability-monitoring | title=Identify website availability issues with Real User Monitoring }} E-commerce and media industries use real user monitoring to correlate site performance to conversions and engagement.{{cite web | url=https://www.catchpoint.com/blog/catchpoint-real-user-monitoring | title=Introducing: Platform Real User Monitoring }}

• It can be analyzed in a sniffer such as Wireshark.
• It can be examined for flows of traffic, providing information on "top talkers" in a network as well as TCP round-trip time.
• It can be reassembled according to an application's state machine into end-user activity (for example, into database queries, e-mail messages, and so on.) This kind of technology is common in real user monitoring.{{cite web | url=https://www.catchpoint.com/guide-to-synthetic-monitoring/rum-vs-synthetic-monitoring | title=Synthetic and Real User Monitoring Explained }}
• In some cases, HTTP reassembly is further analyzed for web analytics.

Passive monitoring can be very helpful in troubleshooting performance problems once they have occurred. Passive monitoring differs from synthetic monitoring in that it relies on actual inbound web traffic to take measurements, so problems can only be discovered after they have occurred. Synthetic monitoring is also referred to as active monitoring, which helps report on system availability and predefined business transactions using synthetic probes and web robots.{{cite web |url=http://www.apmdigest.com/prioritizing-gartners-apm-model |title=Prioritizing Gartner's APM Model |date=15 March 2012 |publisher=APM Digest }}

While initially viewed as competitive with synthetic monitoring approaches, most networking professionals now recognize that passive and synthetic monitoring are complementary.