passive measurement

Imagine a quiet observer sitting beside a busy road, simply counting the cars that go by, noting their colours and how fast they travel. They never drive a car of their own; they only watch the traffic that was always going to be there. Passive measurement is this approach for networks: instead of injecting probes, you observe the real traffic that is already flowing and learn from it. Nothing extra is added to the network, so what you measure is genuinely what users are experiencing.

Concretely, a passive measurement point taps a link or reads counters that the equipment already keeps. A packet-capture tool like tcpdump or Wireshark records the actual packets crossing an interface. A flow exporter such as NetFlow or IPFIX summarises traffic into records — who talked to whom, on which ports, how many bytes and packets — without storing every packet. Even the humble interface counter inside a switch ("bytes in, bytes out, errors") is passive: you periodically read a number that the device increments as real traffic passes. The data is the network's own behaviour, captured rather than provoked.

The honest limits are the mirror image of active measurement. Because you only see traffic that exists, you cannot answer "is this idle path healthy?" if nothing is using it — there is nothing to observe. At high speeds, capturing every packet is expensive and can overwhelm storage, so passive tools sample or summarise, trading completeness for feasibility. And capturing real user traffic raises serious privacy and legal questions, since those packets carry real people's data. Passive measurement excels at continuous, low-impact insight into what is actually happening; active measurement excels at asking a pointed question right now.