16) Network Monitoring

Simple Network Management Protocol (SNMP) is a widely used protocol for network management.
It allows administrators to monitor, configure, and control network devices.
It operates at the application layer of the OSI model.
Provides a standardized framework for managing devices in a network.

SNMP traps are unsolicited messages sent from an SNMP-enabled device to a management station.
The purpose of traps is to notify the management station of significant events or conditions.
Management Information Bases (MIBs) contain information about network devices in the form of data objects.
MIBs track specific metrics including:
- Status
- Capacity
- Performance

SNMP v2c (Simple Network Management Protocol version 2 community-based) is an extension of the original SNMP protocol.
- It offers enhancements such as bulk retrieval capabilities.
- It lacks robust security features.
- Authentication relies on plain text community strings.
SNMP v3 is the most secure version of the Simple Network Management Protocol.
- It provides important security enhancements over predecessor versions.
- It supports strong authentication and encryption.
- It significantly improves the security of network management operations.
- SNMP v3 enhances security through robust authentication mechanisms that verify the identity of the source and destination before allowing access to network data.

Community strings grant access to device information.
There are two common community strings used in network management:
- Public: This mainly provides read-only access.
- Private: This generally provides read-write access.
Configuration example on a router interface:
- Router#configure terminal
- Enter configuration commands, one per line. End with CNTL/Z.
- Router(config)#
- Router(config)#snmp-server community public RO
- Router(config)#snmp-server community private RW

Flow Data involves capturing and analyzing metadata about network traffic.
- Captured metadata includes source and destination IP addresses, port numbers, and protocol types.
- It is essential for understanding traffic patterns and bandwidth usage.
- It helps identify potential security threats or bottlenecks within the network.
Packet capture (pcap) is the process of intercepting and logging traffic that passes over a digital network.
- Performance of packet capture acts as a diagnostic tool.
- It helps administrators thoroughly examine network traffic to diagnose performance issues.
- It is used to detect malicious activities.

Baseline Metrics establish a standard level of normal network performance.
- These metrics include typical traffic volume, performance speeds, and error rates.
- Establishing these metrics is crucial for effective network management.
- They aid in the early detection of issues and ensure performance remains within expected parameters.
Anomaly Alerting and Notification systems automatically detect and report deviations from established baseline metrics.
- Deviations signal potential performance or security issues.
- These systems ensure rapid response to unusual activity.
- They maintain network integrity and performance by prompting timely intervention.

Log Aggregation involves collecting, consolidating, and analyzing computer-generated log messages from various sources across the network.
- This centralized approach assists in monitoring, diagnosing, and managing data.
- It ensures efficient network operations and security compliance.
Security Information and Event Management (SIEM) technology provides real-time analysis of security alerts.
- Alerts are generated by network hardware and applications.
- SIEM aggregates and correlates log data.
- It enables automated alerting and reporting.
- It supports proactive security measures by identifying potential threats based on unusual activity patterns.
A syslog collector is a dedicated tool used for gathering log data generated by devices within a network.
- It centralizes syslog messages from multiple sources.
- It simplifies management and enhances security monitoring.
- It aids in troubleshooting processes.

Application Programming Interfaces (APIs) are used to allow seamless integration between different software systems.
- APIs facilitate automated network configurations.
- They are used for data extraction and the synchronization of network management tools.
- They enhance efficiency and scalability.
Network solutions encompass various tools and techniques used to manage, monitor, and secure network infrastructure.
- They ensure optimal performance, security, and reliability via continuous oversight and proactive management.
Network discovery involves identifying devices, servers, and hardware components connected to a network.
- Ad hoc network discovery: Performed manually on an as-needed basis to provide immediate visibility when specific issues or updates arise.
- Scheduled network discovery: Automated and occurs at regular intervals to ensure consistent and up-to-date network mapping.

Traffic analysis involves examining data packets flowing through the network.
- Used to identify usage patterns, bandwidth consumption, and potential bottlenecks.
- Provides insights to optimize performance and ensure adequate bandwidth distribution.
Performance monitoring tracks metrics such as response times, throughput rates, and error rates to evaluate health and efficiency.
Availability monitoring ensures that all critical network components are operational and accessible to users.
- It detects downtime and failures.
- It allows network teams to quickly address issues and minimize service disruptions.
Configuration monitoring involves tracking changes to network device configurations.
- Prevents unauthorized modifications.
- Ensures compliance with security policies.