Act of examining network traffic to get an overview of common ports and protocols used and monitor for threats. Tools Tcpdump Wireshark