Network Monitoring

This objective focuses on visibility: how to look inside your network to see what devices are running, how much bandwidth is being consumed, and how to spot performance issues or security threats before they take down your infrastructure.

Let’s break down these network monitoring tools, data gathering methods, and automated solutions.

1. Network Monitoring Methods (How We Get Data)

To monitor a network, you first need a way to gather statistics and system events from your hardware.

SNMP (Simple Network Management Protocol)

SNMP is the universal industry standard for monitoring and managing network devices such as routers, switches, servers, and firewalls from a central dashboard.

• MIB (Management Information Base): The data directory or dictionary layout built into the device. It defines exactly what stats the device can report (e.g., CPU temperature, interface packet drops). It uses a structured hierarchy of numbers called OIDs (Object Identifiers) to pinpoint data points.
• Traps: Normally, a central monitoring server periodically requests stats from a switch (polling). However, an SNMP Trap is an alert sent spontaneously by the device to the central server at the exact millisecond an unexpected crisis occurs (e.g., “Power supply fan failed!” or “Port 5 went down!”).
• Community Strings: The unencrypted text passwords used in older versions of SNMP to grant access to a device’s MIB data.
• SNMP Versions (Crucial for the Exam):
  • SNMPv1 / SNMPv2c: Older versions. They transmit all data and community string passwords in clear text. They are highly vulnerable to sniffing.
  • SNMPv3: The modern, secure standard. It introduces full Authentication (ensuring the message came from a trusted source) and Encryption (scrambling the traffic so eavesdroppers cannot read your network stats or passwords).

Flow Data (NetFlow / sFlow / IPFIX)

• What it is: Flow monitoring examines network traffic metadata rather than individual packet payloads. It tracks the “conversation details”: Source IP, Destination IP, Port numbers, Protocol, and the total data size sent.
• Analogy: Think of Flow data like a detailed phone bill. It doesn’t record your phone conversations, but it tells you exactly who you called, when you called them, and how long you talked. It is incredibly useful for mapping out bandwidth congestion bottlenecks.

Packet Capture & Port Mirroring

• Packet Capture (PCAP): Deep, granular inspection. It intercepts and copies the raw, complete binary frames as they move over the wire, down to the payload data. Tools like Wireshark are used to read these.
  • Analogy: Actually recording and listening to the audio of the phone conversation.
• Port Mirroring (SPAN/RSPAN): Switches normally forward traffic directly from the source port to the destination port, thereby isolating other interfaces. If you plug a packet-capturing server into Port 10 to monitor traffic, it won’t see anything. Port Mirroring tells the switch: “Take a copy of all traffic moving through Port 1 and duplicate it out of Port 10 so my monitoring server can inspect it.”

Log Aggregation: Syslog & SIEM

• Syslog Collector: A central server that serves as a storage bucket for the text-based log messages automatically generated by routers, firewalls, and servers (via standard UDP Port 514).
• SIEM (Security Information and Event Management): A highly advanced system that goes far beyond a basic Syslog collector. A SIEM acts as an intelligent security brain. It aggregates logs from thousands of sources, correlates data in real time, and flags complex attacks.
  • Simple Example: If a server logs a single failed password attempt, a SIEM ignores it. But if a firewall logs an unknown IP scanning ports, and simultaneously an internal server logs 500 failed password attempts in 10 seconds, the SIEM connects the dots, recognizes a brute-force attack, and sounds the alarm.

API Integration

• What it is: Application Programming Interfaces allow monitoring platforms to query modern cloud providers or software-defined infrastructure directly. Instead of using legacy protocols like SNMP, the monitoring tool uses an API to pull real-time environment metrics, system states, and container statistics securely over HTTP.

Baseline Metrics & Anomaly Alerting

• Baseline Metrics: Running monitoring tools for days or weeks to establish what a “normal” operating day looks like on your network (e.g., our average CPU usage is 25%, and our internet pipe peaks at 400 Mbps at 2 PM).
• Anomaly Alerting: Once the baseline is established, you configure thresholds. If traffic suddenly spikes to 99% usage at 3 AM on a Sunday, the system flags this deviation from the baseline as an anomaly and instantly alerts the administrator via email, text, or Slack.

2. Monitoring Solutions (The Systems We Run)

Enterprise monitoring tools combine these methods into comprehensive, continuous software dashboards to track five major areas:

• Network Discovery: Scanning the network to identify all active assets.
  • Ad hoc: A technician manually triggers a one-time scan right now to find a rogue device.
  • Scheduled: The system runs automatically every night at midnight to check for new hardware additions and update the asset management inventory.
• Traffic Analysis: Examining what is consuming your internet bandwidth using Flow data. It helps you see if your bandwidth is being used for corporate database syncing or employees streaming media.
• Performance Monitoring: Tracking system resource vitals over time, such as CPU load, RAM usage, interface packet drop rates, and link errors.
• Availability Monitoring: The basic but vital “Up/Down” checking. It uses simple tools like ICMP pings or TCP port checks to verify if a critical router, web server, or remote branch link is online and reachable.
• Configuration Monitoring: Tracking changes made to device configurations. It alerts administrators if a firewall rule is edited or a switch port setting is altered, helping maintain compliance and allowing quick rollbacks if a bad tweak causes a network issue.

Network Monitoring Study Matrix

Technology / Method	Core Data Source	Primary Focus / Exam Cue
SNMPv3	MIB / OIDs	Network statistics with authentication and encryption.
Flow Data (NetFlow)	Traffic Metadata	Bandwidth mapping; tracking conversations (IP-to-IP).
Port Mirroring (SPAN)	Switch Hardware	Duplicating traffic from one live port to a packet sniffer.
SIEM	Cross-platform Logs	Security log correlation; flags multi-step attacks.
Baseline	Historical Analytics	Finding normal operation values to spot future anomalies.