What Is Network Monitoring?

Network monitoring is the continuous or periodic observation of network devices, connections, services, and performance to identify availability, performance, and operational problems.

A network monitoring system collects information from network infrastructure and presents it to administrators through dashboards, graphs, alerts, and reports.

                Network Monitoring System
                         |
          +--------------+--------------+
          |              |              |
          v              v              v
        Router         Switch         Firewall
          |              |              |
          +--------------+--------------+
                         |
                    Monitoring Data
    

Why Is Network Monitoring Important?

Without monitoring, administrators may discover a network problem only after users start reporting it.

With monitoring, important events can be detected and investigated much earlier.

• Detect device failures
• Identify interface problems
• Monitor bandwidth usage
• Track latency and packet loss
• Monitor CPU and memory utilization
• Identify unusual traffic patterns
• Receive alerts about important events
• Analyze historical performance

What Can Be Monitored?

1. Device Availability

Monitoring systems can determine whether devices are reachable and responding.

```

Router
|
| Monitoring Check
v
Monitoring Server
|
+---- UP
|
+---- DOWN 

2. Interface Status

Administrators can monitor whether network interfaces are up or down and examine interface statistics.

3. Bandwidth

Monitoring interface traffic helps administrators understand utilization and identify heavily used links.

4. CPU and Memory

High CPU or memory utilization can indicate configuration, workload, software, or other operational issues.

5. Latency and Packet Loss

Monitoring latency and packet loss can help identify connectivity and performance problems.

6. Network Events

Logs and notifications can reveal interface changes, authentication events, configuration changes, and other events.

Availability Monitoring vs Performance Monitoring

Active vs Passive Monitoring

Active Monitoring

Active monitoring sends tests or probes and measures the responses.

```

Monitoring Server
|
| Ping / Probe
v
Network Device
|
| Response
v
Monitoring Server 

Examples include connectivity checks and synthetic service tests.

Passive Monitoring

Passive monitoring observes information already generated by network devices or traffic flows instead of actively generating the test traffic.

Examples include collecting SNMP counters, Syslog messages, or flow records.

Technologies Used in Network Monitoring

SNMP in Network Monitoring

SNMP can allow a monitoring system to retrieve information from supported network devices.

```

Monitoring Server
|
| SNMP Request
v
Router / Switch
|
| SNMP Response
v
Monitoring Server 

Depending on the device and configuration, information such as interface counters, device uptime, CPU utilization, and other management objects can be monitored.

Network Monitoring Architecture

                     Monitoring Dashboard
                            |
                            v
                   Monitoring Platform
                            |
          +-----------------+-----------------+
          |                 |                 |
         SNMP             ICMP              Syslog
          |                 |                 |
          v                 v                 v
       Switches           Routers           Firewalls
       Routers            Servers            Servers
       Firewalls
    

A monitoring platform can combine information from multiple sources to provide a broader view of network health.

Alerts and Notifications

Monitoring becomes especially useful when important events trigger alerts.

```

Interface Down
|
v
Monitoring System
|
v
Alert Generated
|
v
Network Administrator 

Alerts may be generated for conditions such as device unavailability, high utilization, interface failures, or other configured thresholds.

Example: Office Network Monitoring

Imagine an organization has:

• 2 Internet routers
• 10 switches
• 5 firewalls
• 20 wireless access points
• Several servers

Instead of manually checking every device, the organization can use a centralized monitoring platform.

                Monitoring Server
                       |
      +----------------+----------------+
      |                |                |
      v                v                v
   Routers          Switches         Firewalls
      |                |                |
      +----------------+----------------+
                       |
                 Alerts / Graphs
    

Administrators can use the collected information to investigate network problems and monitor trends over time.

Network Monitoring vs Network Troubleshooting

Common Network Monitoring Metrics

• Device availability
• Interface status
• Bandwidth utilization
• Packet loss
• Latency
• CPU utilization
• Memory utilization
• Interface errors
• Traffic volume
• System uptime

Quick Quiz

What is the main purpose of network monitoring?

Which protocol is commonly used for device monitoring?

Which technology is commonly used to collect network log messages?

Key Takeaways

• Network monitoring observes network health and performance.
• Availability monitoring checks whether devices and services are reachable.
• Performance monitoring measures how well the network is operating.
• SNMP can provide device and interface information.
• ICMP can be used for active connectivity monitoring.
• Syslog provides centralized event and log information.
• Flow data can help administrators understand traffic patterns.
• Alerts help administrators respond to important network events.