What Is Network Monitoring?

Network monitoring is the process of continuously observing network devices, connections, services, and performance metrics to identify availability problems, performance degradation, and unusual events.

A network monitoring system can collect information from:

• Routers
• Switches
• Firewalls
• Servers
• Wireless access points
• Network links
• Applications and services

            NETWORK MONITORING SYSTEM
                     |
      +--------------+--------------+
      |              |              |
   Routers        Switches       Firewalls
      |              |              |
      +--------------+--------------+
                     |
            Metrics + Events
                     |
              Monitoring Server
                     |
              Dashboard / Alerts
    

The goal is not simply to collect data. The goal is to turn network data into information that helps engineers understand the current state and investigate problems.

1. What Is Uptime?

Uptime refers to the amount of time a device or service remains operational and available during a defined period.

For example, if a company's router remains operational throughout a month except for a short maintenance window, its measured uptime will be high.

Simple Uptime Calculation

```

Uptime % = (Total Time - Downtime) / Total Time × 100 

For example, if a service is available for 29 days and unavailable for 1 day during a 30-day measurement period:

```

Uptime = (30 - 1) / 30 × 100
= 96.67% 

In real network operations, the measurement period and what counts as downtime should be clearly defined.

What Can Be Monitored for Availability?

• Router availability
• Switch availability
• Internet connectivity
• Server availability
• DNS availability
• Web application availability
• Wireless controller availability

Remember that uptime is not the same as performance. A server can be online while responding very slowly.

2. What Is Bandwidth?

Bandwidth is the maximum data-transfer capacity of a network connection.

Common bandwidth values include:

• 100 Mbps
• 1 Gbps
• 10 Gbps
• 40 Gbps
• 100 Gbps

```

Internet Link
|
|  1 Gbps Capacity
|
+----+----+
| Router |
+----+----+
|
+------ Users
+------ Servers
+------ Wi-Fi 

However, bandwidth should not be confused with actual throughput. A 1 Gbps link has a capacity of 1 Gbps, but the amount of data actually transferred can be lower.

Bandwidth vs Utilization

Monitoring bandwidth utilization helps engineers identify congested links and understand traffic patterns.

3. What Are Network Alerts?

A network alert is a notification generated when a monitored condition matches a configured threshold or event.

For example, a monitoring system could generate an alert when:

• A router becomes unreachable
• An interface goes down
• Bandwidth utilization becomes unusually high
• Packet loss increases
• CPU utilization remains high
• Memory usage reaches a configured threshold
• A monitored service stops responding

      Monitoring System
             |
    +--------+--------+
    |                 |
 Normal            Problem
    |                 |
 Dashboard          ALERT
                      |
                Email / SMS /
                Notification
    

Example

Suppose an organization's Internet interface normally operates around 30–50% utilization. An engineer may configure a monitoring rule that raises an alert when utilization remains above a chosen threshold for a defined period.

Good alert configuration is important. If thresholds are too sensitive, engineers may receive too many notifications, causing alert fatigue.

4. What Is SNMP?

SNMP stands for Simple Network Management Protocol. It is widely used to collect management information from network devices.

   SNMP Manager
   Monitoring Server
         |
         | SNMP
         |
   +-----+------+
   |            |
Router        Switch
 Agent         Agent
   |            |
Counters      Counters
    

Important SNMP Components

• SNMP Manager: Monitoring software that requests or receives management information.
• SNMP Agent: Software running on a monitored device that provides management information.
• MIB: A structured definition of manageable objects.
• OID: An identifier used to identify a specific managed object.

Common SNMP Operations

• GET
• GETNEXT
• SET
• TRAP
• INFORM

Traditional SNMP deployments commonly use UDP port 161 for requests and responses and UDP port 162 for traps and informs.

SNMP Versions

For security-sensitive environments, organizations should carefully evaluate the SNMP version and security configuration they use.

5. What Are Network Logs?

Network devices generate logs describing events that occur on the device. These events can help engineers investigate configuration changes, interface problems, authentication events, failures, and other operational conditions.

```

Router --------
Switch ---------
Firewall --------> Central Log Server
Server ---------/
Access Point ---/
|
v
Search / Analysis 

What Is Syslog?

Syslog is a commonly used mechanism for sending and collecting log messages.

Traditional Syslog commonly uses UDP port 514, although TCP and TLS-based transports can also be used depending on the implementation.

Syslog Severity Levels

Lower numeric values represent more severe conditions.

Cisco Syslog Example

```

Router(config)# logging host 192.168.1.100 

This configures the Cisco device to send logging information to the specified logging host, subject to the platform and remaining logging configuration.

6. What Is a Network Dashboard?

A network dashboard provides a visual view of network health, performance metrics, events, and alerts.

```

+------------------------------------------------------+
|              NETWORK MONITORING DASHBOARD            |
+------------------------------------------------------+
| Devices Online | Interfaces | Alerts | Availability |
|      98        |    184     |   3    |    99.9%     |
+------------------------------------------------------+
|                                                      |
| Bandwidth Utilization                                |
|  10G |██████████████████████              |          |
|                                                      |
+------------------------------------------------------+
| CPU Usage        | Memory Usage | Packet Loss        |
|      42%         |      61%     |      0.2%          |
+------------------------------------------------------+
| Active Alerts                                      |
| - WAN utilization high                              |
| - Access Point unreachable                          |
+------------------------------------------------------+ 

Dashboards make large amounts of monitoring information easier to understand quickly.

Common Dashboard Information

• Device availability
• Interface status
• Bandwidth utilization
• CPU utilization
• Memory utilization
• Latency
• Packet loss
• Interface errors
• Active alerts
• Historical trends

7. How Everything Works Together

Uptime, bandwidth, alerts, SNMP, logs, and dashboards are not isolated technologies. A monitoring platform can combine them to provide a broader picture of network health.

              NETWORK DEVICES
                     |
      +--------------+--------------+
      |              |              |
     SNMP          Syslog          ICMP
      |              |              |
      +--------------+--------------+
                     |
             Monitoring Platform
                     |
      +--------------+--------------+
      |              |              |
   Metrics         Events         Status
      |              |              |
      +--------------+--------------+
                     |
                Dashboard
                     |
                   Alerts
                     |
             Network Engineer
    

For example, SNMP may provide interface counters, Syslog may report an interface event, and an active monitoring probe may detect that the device is unreachable. The monitoring platform can bring these observations together for investigation.

8. Practical Office Network Example

Imagine a company with 100 employees, two switches, a router, firewall, wireless access points, and an Internet connection.

                Internet
                   |
               Firewall
                   |
                Router
                   |
            +------+------+
            |             |
         Switch 1      Switch 2
            |             |
         Users         Servers
            |
          Wi-Fi

                 |
         Monitoring Server
    

The monitoring system could observe:

9. Important Network Monitoring Metrics

10. Why Network Monitoring Is Important

• Detect problems earlier
• Understand network performance
• Investigate incidents
• Identify capacity requirements
• Monitor critical services
• Track historical performance
• Reduce time spent diagnosing problems
• Support proactive network management

Monitoring does not automatically fix a network problem. Instead, it provides the visibility needed to detect, understand, and investigate problems more effectively.

Quick Quiz

Question 1

What does SNMP commonly provide to a monitoring system?

Question 2

What is the difference between bandwidth and utilization?

Question 3

What is Syslog commonly used for?

Question 4

What is the purpose of a monitoring dashboard?

Key Takeaways

• Network monitoring provides visibility into network health.
• Uptime measures how long a device or service remains available during a defined period.
• Bandwidth represents link capacity.
• Utilization shows how much capacity is being used.
• Alerts notify engineers when configured conditions occur.
• SNMP can collect management information from network devices.
• Syslog provides event and log information.
• Dashboards visualize network status, metrics, trends, and alerts.
• Combining multiple monitoring sources gives engineers better visibility.