Passive probing

Passive probing is the process of acquiring control or data from a telecommunication or data network without disturbing the network being monitored. This ensures that applications using the probed data can do so without any threat to the operation of the observed network. This is particularly important for network management/OSS applications where disturbing the observed network with active devices can itself affect network operation and destroy the value of the probed data.

Passive probing is also known as Non Intrusive Monitoring, and also can refer to oscilliscope probes.

Types of probe

Devices performing the probing can be of several forms, largely to meet the physical and transport configuration of the network they are attaching to. Probing is possible on electrical and optical bearers through tapping, optical splitters but is also common using specialised inline devices with failsafe modes. In ethernet networks, managed switches can also offer SPAN port packet duplication, but this is generally inefficient both for the switch and the amount of data that may need to be collected.

The probes typically process the lower layers of the network protocol stacks, removing this information from the data passed on to the application. The lower layers often provide little value for the consuming application, although this is not universally true. Examples of transport layers which are typically removed include ATM, HDLC, MPLS, VLAN, MTPL2, PPP, Frame Relay. In WAN environments, Inverse Multiplexed ATM, PPP Multilink are also common.

Applications

• Operations Support Systems (OSS). These systems offer operators data on how their network is performing, and potential improvements.
• Value Added Services (VAS). Typically these services derive events from normal network operation and offer overlay services. An example of such a service is the Welcome Roamer application where a user roaming in a foreign PLMN is sent a text message by the serving PLMN to welcome the user to the network and advise them of useful short codes or local service.
• Lawful interception (LI) is typically implemented by means of on-switch functionality, however, for many reasons use of a passive probe to achieve this is also a common choice.