📘 11-02: Network Monitoring¶
💡 Why Monitor?¶
Monitoring provides visibility to detect problems, plan capacity, and hold systems accountable. You can't manage what you can't see.
🧰 Monitoring Tools & Protocols¶
| Tool/Protocol | Purpose |
|---|---|
| SNMP (161/162) | Poll device metrics (CPU, interface stats); receive traps |
| NetFlow / IPFIX / sFlow | Analyze traffic flows — who talks to whom, how much |
| Syslog (514) | Centralize device log messages |
| SIEM | Aggregate + correlate logs/events for security |
| Port mirroring (SPAN) | Copy traffic to a sniffer/IDS |
| NMS (PRTG, Zabbix, LibreNMS) | Graph utilization/availability over time |
Use SNMPv3 for authentication and encryption (v1/v2c use plaintext community strings).
📌 Baselines¶
A baseline records normal performance so deviations (spikes, slowdowns, breaches) stand out by comparison. Establish one before you need it.
📌 What to Watch¶
| Signal | Meaning |
|---|---|
| Sustained ~90–100% link utilization | Congestion / bottleneck |
| Rising interface errors/drops | Cabling or congestion problem |
| CPU/memory spikes on devices | Overload or attack |
| Log anomalies | Possible security incident |
🧭 Scenario: Choosing the Right Evidence¶
Different monitoring tools answer different questions during an incident.
| Question | Best evidence |
|---|---|
| Is the device alive? | ICMP, SNMP availability, NMS status |
| Is a link saturated? | Interface utilization graphs, SNMP counters |
| Who is consuming the bandwidth? | NetFlow, IPFIX, or sFlow |
| Did the firewall deny the session? | Firewall logs or SIEM search |
| Are packets malformed or retransmitting? | Packet capture from SPAN/TAP |
| Did this start after a change? | Change log plus time-correlated alerts |
Good troubleshooting uses at least two sources of evidence. For example, high utilization plus NetFlow top talkers is stronger than a single "network is slow" report.
Tip
Key idea — Monitor with SNMP (metrics), NetFlow (traffic patterns), and syslog/SIEM (events). Keep a baseline to spot anomalies, and use SPAN to feed analyzers.
See also: Performance Concepts & QoS, IDS & IPS
Previous: Performance Concepts & QoS | All Notes | Module 11 Exercise | Next: High Availability & Redundancy