Network Monitoring

// Why is network monitoring important?

// The big idea

The network is the lifeline of IT infrastructure

When networks fail, the flow of information required by applications and business operations stops. Network Monitoring Systems (NMSs) monitor the network for problems caused by overloaded or crashed servers, failed network connections, or other device issues.

Network admins use NMSs to monitor availability of network services, functionality of interfaces, status of critical hardware, CPU usage, memory, and bandwidth.

// What an NMS tracks

Three key statistics

Avail.Is the service or device up and responding to requests?

SpeedHow fast is each request being processed? (response time)

RoutesWhat network routes do requests travel through, and are they optimal?

// Security monitoring

Also detects suspicious and unauthorized activity

Network monitoring also discovers unauthorized access and suspicious activity on networks. This can include: network scanning, multiple connection attempts from an unknown entity, unusual or excessive traffic, or unauthorized individuals gaining root or user-level access to a system.

// The 5 functions of a Network Monitoring System

01

Discover

Find every device on the network — routers, switches, servers, firewalls, printers. You can't monitor what you don't know exists. NMSs auto-assign device roles (e.g., Cisco Router vs Dell Server).

02

Map

Visualize how everything connects. A network map is a first-response tool — when a switch fails, every device on it goes down. Seeing this visually saves hours of troubleshooting.

03

Monitor

Continuously watch the "big 5" on every device: Ping availability, CPU, memory, disk, and interface utilization. Also monitors services like HTTP, FTP, and TCP/IP.

04

Alert

Notify admins via email, text, or log when thresholds are crossed. Alerts include a time element (e.g., CPU > 80% for more than 10 minutes) to avoid noise from brief spikes.

05

Report

Deliver real-time and historical data through dashboards. Helps validate network designs, expose trends, and quickly isolate performance problems.

// Syslog

Automated event messaging

Syslog is a built-in automated messaging system on network devices. When a notable event occurs — a config change, an error, a threshold crossed — syslog logs it and can forward the message to administrators. It feeds into the Alert function of the NMS.

// Key tools used in network monitoring

An IDS detects anomalies with the aim of catching hackers before they do real damage. IDSs scan, audit, and monitor the security infrastructure for signs of attacks in progress. They work by looking for signatures of known attacks or deviations from normal activity.

An IDS is placed on the network to monitor the traffic traversing it. This technology alerts system administrators when an attack may be happening. Suspicious or intrusion activity can include: network scanning, multiple connection attempts, unusual or excessive activity, or unauthorized individuals gaining root or user access to a system.

// Think of it like...A security guard watching all entrances. They don't physically stop people themselves, but they notice when something looks wrong and immediately call it in.

SNMP is one of the most widely used protocols for monitoring. It collects data from almost any network-attached device — routers, switches, wireless LAN controllers, access points, servers, printers and more. Most modern network devices have SNMP agents installed by default.

SNMP works by querying Objects — things the NMS collects information about. For example, "CPU utilization" is an SNMP object. The SNMP manager queries agents, gets replies, sets variables, and recognizes events — all without admins manually logging into each device.

Objects are stored in a Management Information Base (MIB). Each object has a unique Object Identifier (OID). An MIB Browser allows admins to navigate through a MIB to find additional objects to monitor.

// Think of it like...An air traffic control tower. The controller (SNMP manager) doesn't ride in every plane — each plane (device/agent) automatically reports its status to the tower, which monitors everything from one screen.

RoutersSwitchesWireless controllersServersPrintersAccess points

// MIB & OID quick reference

How SNMP organizes its data

MIBManagement Information Base — defines all information a device exposes for monitoring. A Cisco router has a different MIB than a Dell server.

OIDObject Identifier — each monitored data point has a unique OID (like a serial number for that piece of data).

AgentSoftware installed on a device that collects and reports monitoring data to the SNMP manager.

ManagerThe central NMS component that queries all agents and assembles their data into one dashboard view.