what sort of capabilities are found in network monitor/protocol analyzer ? why are these important?

Answer 1

These can be executed at a network card, switch port & router level.

They are used to confirm that expected traffic is hitting the relevant network points, traffic on set ports is flowing, direction of traffic is functioning, etc.

For example, if you wanted to confirm that an application on a server is talking to a management server on port 50000 ( just a random number - don't read anythingint the port number ) you would execute an app such as Ethereal to listen to the traffic. You would expect to see activity on this port. If it went OK & failed to receive a response, you would check on the router it was targeted through & read the info on that. If traffic passed through as expected, but, response was blocked; you would see the problem. If not, you would check on the next device ......

On a more unethical note, you could run the software & sniff for traffic, Filter for a certain IP, reform the packets & if needed, grab any http site info, plain text usernames & passwords.

Answer 2

If you do not use any network analyzer tool, it is very difficult to troubleshoot enterprise networks.