Electrical Engineering and Computer Science Associate Professor, Alva Couch laughs recalling those early days. In the beginning, it was outrageous to allow anyone to study an idea like this in my presence, an idea that one can come up with a unified theory and understanding of network administration. This work was improbable. It was improbable that he would challenge some of the basic fundamental tenets of Network Administration and it was much more improbable that I would believe him. Typical network monitoring is based on measuring behavior and comparing it with what is considered 'normal'.
Measurements often take the form of statistics on what the network is doing.
If a measurement goes out of range, someone is paged to fix the problem. The problem is that in a 'normal' operation, network statistics vary wildly depending upon how people are using the network, so that simple methods of detecting problems by checking statistics don't work. Whatever you can measure and limit, you can react to. When you can't measure something or can't figure out what's allowable, you can't react. Couch explains this with a simple example.