A baseline is a snapshot of normal network behavior, and it’s one of the most powerful tools for detecting anomalies. This episode explores how to create, maintain, and use network baselines effectively. You’ll learn how to define what “normal” looks like in terms of bandwidth, latency, and traffic patterns, and how to detect deviations that indicate issues or intrusions.

We also introduce NetFlow, a protocol developed by Cisco that collects metadata about traffic flows. We explain how to interpret flow data to understand who is talking to whom, over what protocol, and for how long. Used together, baselines and flow analytics help network teams spot bandwidth hogs, rogue devices, or developing threats before they escalate.