To understand the issue of network monitoring, it is better first to familiarize yourself with the OSI network model because a basic understanding of networks starts with the Open Systems Interconnect or OSI model. The OSI model standardizes the basic functions of a network using network protocols.
Network monitoring
The network’s second, third, and seventh layers are the most common layers used for network monitoring. Network monitoring systems use these layers to discover devices on the network and how they are connected, generate network topology maps, and monitor the network.
Before addressing the topic of network monitoring, it is better to know the common devices in the network, which are as follows:
- Routers: Routers connect the network as a private network to the Internet. A router acts as a distributor and chooses the best path for information exchange. Routers connect users to the Internet—routers aa third-layered devices.
- Switches connect computers, servers, and other devices to the private network. A switch as a controller can communicate with each other in the network. Switches are layer two devices.
- Firewalls: Firewalls protect networks. The firewall controls incoming and outgoing traffic based on rules. A firewall creates a secure barrier between a trusted private network and an untrusted network such as the Internet.
- Servers: Networks deliver programs and information to users. Programs and information are placed on servers. A server is a running instance or copy of an application. The server receives user requests and responds accordingly; for example, when accessing a website, a web server serves web pages to your local machine. Examples of other servers include email servers and database servers.
During network monitoring, how does data pass through the network?
Now, you may have a question, how does the data pass through the network during network monitoring? Most private networks are connected to the Internet. For example, the Internet connects remote users to central offices and customers to websites to monitor the Internet. Private networks are connected to the Internet using a router. Information is sent over the Internet in the form of data packets.
Each data packet contains a destination IP address routers use to send information from one location to another. When the router receives a data packet from the Internet, it forwards it to the private network. In most networks, data packets must first pass through a firewall, which is to keep the traffic from being bad and the private network secure. A firewall filters traffic between the Internet and the private network.
When firewall rules mark an incoming data packet, it is blocked from the private network. Firewalls also control user access between the Internet and the private network. For example, a firewall can be configured so that users from the private network cannot use certain protocols such as peer-to-peer. This is how firewalls protect private networks from unauthorized access, malware, and other security threats. A switch in the private network receives data packets that pass through the firewall.
Switches connect laptops, servers, printers, and other devices to a private network. These devices are connected to the switch using a network interface card or NIC. Each NIC has a unique media access control or MAC address. Switches transfer data between devices using these MAC addresses.
Why is network monitoring important?
But why is the topic of network monitoring so much attention? To answer this question, we can say that the network is the lifeline of the IT infrastructure. When networks fail, the flow of information needed by business applications and operations stops.
Networks are dynamic environments, so network administrators are constantly asked to add new users, technologies, and applications to their networks. These changes can affect their ability to provide consistent and predictable network performance. When network problems arise, the admin is under pressure to determine the root cause before it affects users, applications, and businesses.
Solving this issue is more problematic with intermittent performance issues that are difficult to replicate and diagnose. Many IT organizations are subject to Service Level Agreements or SLAs. You may wonder if SLA is a contract between IT and business owners. SLA commitments are often included in IT compensation plans. SLAs are performance guarantees that are measured and reported.
But why are SLAs important? Because poor performance and low time are costly. For an e-commerce website like LL Ben, an hour of downtime can cost millions. SLA requirements can be very specific. The stricter the SLA, the more expensive it is to implement and maintain. For example, providing four or five nines requires the network administrator to configure their network switches as redundant pairs. A third switch must be readily available for a swap in case of failure.
Five main functions of network monitoring systems
So far, we have talked about the principles of network construction, and now we want to talk about the principles of network monitoring systems or NMS. Network monitoring systems provide five main functions, which are:
- discover
- Map
- Monitor
- Alert
- Report
It should be noted that the network monitoring tool is different in the capabilities provided for each of these functions.
Discovery
To start network monitoring, you must first find the devices on the network. Network monitoring begins with the discovery process. In simpler terms, it can be said that if you do not know what is in the network and how they are all connected, you cannot monitor it. Network monitoring systems discover devices on the network such as routers, switches, firewalls, servers, printers, and more. Network monitoring systems include a library of monitoring patterns that define how to monitor a device.
Be aware that devices are vendor-specific. For example, what you monitor on a Cisco router will be different than what you monitor on a Dell server. When a network monitoring system begins the discovery process, it automatically assigns the appropriate device role to each discovered device.
Network monitoring systems differ in their ability to discover. All NMSs discover devices on the network. However, not all network monitoring systems discover how devices are connected. For example, an NMS may have detected a server on the network but not know which switch it is connected to. An NMS discovers port-to-port connectivity between devices on the network by layer 2 or 3. It is not enough to know what device is on a network for effective network monitoring. You need to know how all these devices are connected because a performance problem in one device can affect the performance of another device. For example, when a switch fails, all the devices connected to that switch cannot communicate through the network. If this switch is connected to the servers that support the organization’s CRM system, it is considered a big problem.
Map
For network monitoring, it is better to visualize your network. The eyes of a network administrator are the most valuable diagnostic tools in networks. Their ability to visualize their networks can save hours and even days in solving network problems. Still, unfortunately, network wiring is so complicated that it limits the administrator’s ability to visualize the network and prevents problem-solving. Network monitoring systems create network maps. Network maps are a powerful first response tool that enables network administrators to visualize their networks. They are a tidy representation of the wiring parts. Many NMSs require significant manual processing to create a network map. Some provide a network drawing tool and rely on the administrator’s network knowledge.
Monitor
As mentioned, network monitoring systems provide the role of turn-key devices that determine what needs to be monitored. Network admins can change device roles or create new ones from scratch. Network monitoring systems expose the network administrator to a large selection of monitors. As a starting point, network admins want to monitor the big 5 for every resource on the network, including Ping availability and latency, CPU utilization, memory, disk, and interface utilization. Most network monitoring tools monitor other hardware components, such as fans and power supplies in a switch, and even monitor the temperature while wiring. They can monitor network services such as HTTP, TCP/IP, and FTP.
Alert
Network monitoring systems notify the network administrator when something goes wrong. They send alerts via email, text, and log in. Threshold-based alerting enables network administrators to respond to problems before they affect users, applications, or businesses. For example, network monitoring systems are set when more than 80 percent of the CPU is in use, allowing the network administrator to address and react before the router goes down completely. Some NMS allows network Admins to set a blackout period when alerts stop, e.g., printers turn off at night to save energy costs. NMSs can be configured to suspend printer alerts during evening hours.
Report
Network managers are constantly involved in network design, analysis, and redesign life cycle. Network monitoring systems provide real-time and historical monitoring data to support the lifecycle. So This information enables the network administrator to:
validate that the network design provides the desired results.
show the appearance of trends affecting the network’s ability to provide the performance required by users, applications, and businesses.
quickly isolate and fix performance issues
Proof of SLA commitments
Network monitoring systems provide monitoring information on web pages called dashboards. The dashboard consists of its turn-key views. Network admins scan concise dashboards to assess overall network improvement. Most NMSs are configurable. In addition Network, admins can create a dashboard for their internal customers.
How does a monitoring tool work?
Network monitoring systems monitor network devices and servers for performance data using standard protocols such as:
- SNMP, Simple Network Management Protocol
- WMI or Windows Machine Interface
- SSH or Secure Shell for Unix and Linux servers
Some network monitoring systems support scripting languages such as Powershell to create custom monitors for Windows servers and Display to create custom monitors for databases. Two widely used monitoring protocols are SNMP and WMI. They provide Network Admins with thousands of monitors to assess the health of their networks and devices.
SNMP is a standard protocol in network monitoring systems that collects data from almost any network-connected device, including routers, switches, wireless LAN controllers, access points, servers, printers, and more. So Other Objects queried by SNMP are stored in a Management Information Base or MIB.
The MIB defines all the information exposed by the managed device. For example, the MIB for a Cisco router contains all Cisco-defined objects that can be used to monitor that router, such as CPU usage, memory usage, and interface status. Objects in the MIB are classified using a standard numbering system. Each object has a unique object identifier or OID. Some NMSs offer a MIB browser. The MIB browser allows the network administrator to navigate the MIB to find other objects they want to monitor on a device.
WMI is a protocol for network monitoring systems to monitor Microsoft Windows-based servers and applications. WMI is Windows-specific and does not monitor non-Microsoft network devices or servers. You can monitor a user’s WMI to monitor almost anything on a Windows server that you can monitor with SNMP. WMI uses more CPU and memory to process more than SNMP.
Frequently Asked Questions
What is a network monitoring system?
The network monitoring system monitors and checks access and how users work in a network. In these systems, different network hardware and software are used in different working layers to create a complete network map.
During network monitoring, how does data pass through the network?
Most private networks are connected to the Internet. For example, to monitor the Internet, the Internet connects remote users to central offices and customers to websites. Private networks are connected to the Internet using a router. Information is sent over the Internet in the form of data packets. Each data packet contains a destination IP address routers use to send information from one location to another.
Why is network monitoring important?
The network is the lifeline of IT infrastructure. When networks fail, the flow of information needed by business applications and operations stops. Networks are dynamic environments, so network administrators are constantly asked to add new users, technologies, and applications to their networks, and these changes can affect their ability to provide consistent and predictable network performance. to affect
What are the five main functions of network monitoring systems?
One: Discover, Two: Map, Three: Monitor, Four: Alert, Five: Report.