Why watch
A monitoring server keeps watch on the network. Every minute it asks the router and the switch for their numbers and draws them on a live graph. When something goes wrong, a person knows first, before users start complaining.
SNMP polling
They speak SNMP, the Simple Network Management Protocol. The server is the manager; each device runs a small helper program called an agent. The manager sends a GetRequest to the agent on UDP port 161: please tell me this number.
Every number has an address called an OID, a dotted path like a library shelf mark. A MIB is the catalogue that defines them. The interface MIB lists, for each port, bytes in and out, errors, and whether it is up.
The agent replies with a counter: the total bytes sent out of the internet port since it started. One reading says little. The manager subtracts the last reading and divides by the time between them: 60 Mbit/s.
Graphs and alerts
Each rate becomes a dot, and the dots join into a line. Over time the line shows what normal looks like, so odd moments stand out. 60 Mbit/s on a 100 Mbit/s link means it is 60% full.
A threshold is a rule: alert if the link stays above 90% for 3 polls in a row. Waiting 3 polls stops one short spike from waking anyone. The line crosses, and the server sends an alert to the on-call admin.
Devices speak up
Some news should not wait for the next poll. When a cable is pulled from port 7, the switch's agent sends a trap, an unasked message, to UDP port 162. A trap can be lost, so polling carries on as a safety net.
Devices also write text log lines and send them with syslog, usually to UDP port 514. Each line has a time, the device's name and a severity, from 0, emergency, to 7, debug. The server stores them so people can search later.
Who, and what next
Counters say how much, not who. A flow is one conversation: same addresses, ports and protocol. The router counts each flow and exports records with NetFlow or IPFIX. They show one PC's backup used 84 of the 96 Mbit/s.
SNMP versions 1 and 2c guard access with a shared word, the community string, sent as plain text: anyone on the path can read it. SNMPv3 adds proper user logins. Messages can be signed, and encrypted too.
Newer devices can push instead of waiting to be asked. With streaming telemetry the server subscribes once, then the router sends its counters every 10 seconds over one open connection. Short spikes that a one-minute poll would blur now show up.
On the wire
;; step 1/11 · watch · poll ;; Monitoring server → Edge router monitoring srv 192.168.1.5 watches router 192.168.1.1, switch 192.168.1.2 every 60 s (illustrative) collects counters, traps, syslog, flow records shows graphs, alerts
Here one monitoring server is the SNMP manager, the flow collector and the syslog server. Bigger networks split these roles across several machines. Counters wrap back to zero when they overflow: a 32-bit byte counter wraps after 4 294 967 296 bytes, about every 344 s at 100 Mbit/s, which is why fast links are polled through the 64-bit "HC" counters (RFC 2863).