Sniffers are the latest incarnation of network analysis tools. Currently the better products are promoting increased sophistication such as the ability to sift out web traffic from other network traffic, and the concept of an 'application' view of network traffic.

The merits of this approach are that it is proven and reliable technology. The sniffers usually place a low processing load on the system themselves; so do not contribute to any performance problems by their own analysis. This network-oriented approach will please the 'network-philes' who insist that whatever the question, the answer always lies in looking at the network.

Difficulties remain however. The concept of an application and pseudo-transactions appears to be predominantly marketing hype at this stage - as network marketers attempt to move network analysis closer to the business. The reality is that the application as perceived by sniffers does not relate closely to the application as viewed from the business servers and legacy/back-end systems. It is even further from the application as viewed by the business. Thus correlation of the data gathered with other aspects of the processing, essential to effectively manage the performance of the system, is a difficult and time consuming task.

The sniffer might show that the bulk of the response time is taking place at a particular server. Other tools will still be required to show where the problem lies within that server and predict what benefit will be gained from changing the server to overcome the problem.