What is a primary advantage of passive monitoring over active monitoring?

The primary advantage of passive monitoring is that it is non-intrusive. It works by observing and analyzing actual user traffic as it crosses the network, using methods like packet capture, NetFlow, or SNMP. Because it does not generate any new or synthetic packets, it does not consume additional bandwidth or alter the network's behavior. This allows it to provide insights into real-time performance and actual user experience without any risk of impacting the network services it is intended to monitor.

A. Measuring performance under synthetic conditions is a characteristic and advantage of active monitoring, not passive monitoring.

C. Generating test traffic to simulate user behavior is the definition of active monitoring, such as using an IP SLA HTTP operation.

D. Active monitoring is generally better for directly measuring specific services on-demand, as it can test a service even when no real users are active.

1. Dharmapurikar, S., & Krishnamurthy, P. (2008). "System and method for passive real-time measurement of network performance." U.S. Patent No. 7,447,163. Washington, DC: U.S. Patent and Trademark Office. The patent background discusses that passive techniques "do not inject any traffic into the network and hence are non-intrusive."

2. Clark, D. D., & Blumenthal, M. S. (2001). Rethinking the design of the Internet: The end-to-end arguments vs. the brave new world. National Research Council. This and similar foundational networking texts discuss the trade-offs, noting passive monitoring's benefit of observing real traffic without interference.

3. Cisco Systems, "Cisco IOS NetFlow," White Paper, 2007. The paper describes NetFlow as a passive technology, stating, "NetFlow provides a key set of services for IP applications... without introducing overhead on the network itself."