Lesson 59 · Operations

Monitoring: SNMP and flows

Good network teams hear about trouble before their users do. Follow a monitoring server as it polls a router and a switch with SNMP, turns raw counters into a live traffic graph, and raises an alert when the internet link stays too full. Then see devices speak up on their own with traps and syslog, flow records reveal who filled the link, SNMPv3 keep it private, and streaming telemetry push numbers every few seconds.

11 min11 steps5 questionsBeginner

Fig 59 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01The router's out-bytes counter reads 912 345 678 900 at 10:00:00 and 912 795 678 900 at 10:01:00. What was the average rate?

The difference is 450 000 000 bytes. Times 8 is 3 600 000 000 bits, divided by 60 seconds is 60 000 000 bit/s, or 60 Mbit/s. A single counter reading means little; only the difference between two does.

02The rule is: alert if the uplink is above 90% for 3 polls in a row. Why wait for 3 polls instead of alerting on the first one?

A single busy minute is normal and soon passes. Here the polls read 93, 95 and 96 Mbit/s on a 100 Mbit/s link, all above 90%, so the rule fires on the third one. A lone 93 followed by 60 would not.

03Which of these does the monitoring server have to ask for, poll by poll?

Polling means the manager sends a GetRequest to the agent on UDP 161 and gets a Response back. Traps, syslog lines and telemetry updates are all sent by the device on its own. A trap is unacknowledged UDP, so it can be lost, which is why polling carries on as a safety net.

04The uplink graph shows the link is 96% full. What tells you which computer is using it?

Counters say how much traffic passed, not who sent it. A flow record lists the addresses, ports and protocol of each conversation, with its packets and bytes.

05What does SNMPv3 add over SNMP versions 1 and 2c?

v1 and v2c send the community string in clear text, so anyone on the path can read and reuse it. SNMPv3's User-based Security Model lets messages be signed (authentication) and encrypted (privacy). The lowest level, noAuthNoPriv, turns both off, so real networks use authPriv.

Key terms

Glossary

SNMP: Simple Network Management Protocol: a manager asks agents on network devices for numbers, and agents can send traps.
Manager / agent: The manager is the monitoring software that asks; the agent is the small program on each device that answers.
OID and MIB: An OID is the dotted address of one value, like 1.3.6.1.2.1.31.1.1.1.10.2; a MIB is the catalogue that defines a set of them.
Counter: A number that only goes up, like total bytes sent; a rate comes from the difference between two readings.
Threshold: A rule that raises an alert when a value crosses a limit, often only after several readings in a row.
Trap: A message a device's agent sends without being asked, such as 'port 7 is down', to UDP port 162.
Syslog: A standard way for devices to send text log lines, each with a time, host name and severity from 0 to 7.
Flow record: A summary of one conversation (addresses, ports, protocol, packets, bytes) exported by NetFlow or IPFIX.

Fine print

Notes and sources

The 60-second poll, the 90% for 3 polls rule, the 10-second stream, the counter readings and the graph are illustrative; the arithmetic on them is exact (450 000 000 bytes × 8 ÷ 60 s = 60 Mbit/s).
The office uses 192.168.1.0/24 (RFC 1918); the cloud backup server 203.0.113.10 is an RFC 5737 documentation address. As the router sees LAN traffic before NAT, its flow records show the PC's private address.
Counters wrap back to zero when they overflow: a 32-bit byte counter wraps after 4 294 967 296 bytes, about every 344 s at 100 Mbit/s, which is why fast links are polled through the 64-bit "HC" counters (RFC 2863).
Here one monitoring server is the SNMP manager, the flow collector and the syslog server. Bigger networks split these roles across several machines.
Busy routers often sample flows, counting 1 packet in N and scaling up, so flow totals are estimates while interface counters are exact.

Quiz Unlocks after the last step.