CompTIA Network+ Preparation · lesson 16 of 30 · 25 min
Why Network Monitoring Matters
Network monitoring provides visibility into device health, traffic patterns, and security events. Without monitoring, outages go undetected, attacks succeed silently, and capacity planning is guesswork. The Network+ exam covers the tools and protocols used to collect and analyze network data.
SNMP — Simple Network Management Protocol
SNMP collects performance data and configuration information from network devices. Components:
NMS (Network Management System) — the management station that polls devices and receives traps (e.g., SolarWinds, PRTG, Nagios).
Agent — software running on the managed device that responds to polls and sends traps.
MIB (Management Information Base) — hierarchical database of variables the agent exposes (CPU, interface counters, error rates).
OID (Object Identifier) — unique numeric identifier for each MIB variable (e.g., 1.3.6.1.2.1.1.1 = sysDescr).
SNMP Operations: GET (read one variable), GETNEXT (read next variable), GETBULK (read multiple), SET (write a variable), TRAP (unsolicited alert from agent), INFORM (acknowledged trap).
Versions: v1/v2c use community strings (insecure). v3 adds authentication and encryption — always use v3 in production.
Syslog
Syslog centralizes log messages from all network devices to a syslog server. Uses UDP port 514 (or TCP 6514 for TLS-encrypted syslog). Messages include: timestamp, hostname, facility (source subsystem), severity (0–7), and message text.
Facilities identify the source: kern (0), user (1), mail (2), daemon (3), auth (4), syslog (5), local0–local7 (16–23). Network devices typically use local0–local7.
Best practice: synchronize all device clocks with NTP before enabling syslog — timestamps are useless without accurate time.
NetFlow and IPFIX
NetFlow (Cisco) and IPFIX (IETF standard) collect flow-level traffic statistics. A flow is defined by 5-tuple: source IP, destination IP, source port, destination port, protocol.
NetFlow data is exported to a flow collector for analysis. Provides: top talkers, bandwidth usage by application, traffic baselines, and anomaly detection.
NetFlow does NOT capture packet content — it captures metadata (who talked to whom, how much, when). This makes it privacy-safe for traffic analysis.
Versions: NetFlow v5 (fixed fields), NetFlow v9 (flexible template-based), IPFIX (standardized v9).
SIEM — Security Information and Event Management
A SIEM aggregates logs and events from multiple sources (firewalls, IDS/IPS, servers, endpoints, network devices), correlates them, and generates alerts for security incidents.
Key SIEM capabilities: log aggregation, correlation rules (detect patterns across multiple events), alerting, dashboards, forensic search, and compliance reporting.
Examples: Splunk, IBM QRadar, Microsoft Sentinel, Elastic SIEM.
Baseline — a documented record of normal network behavior (traffic volume, protocol mix, top applications). Deviations from baseline trigger alerts. Establishing a baseline requires monitoring over time (days to weeks).
Exam Tip — Monitoring Tool Selection
Net+ exam scenario questions often ask which tool to use: SNMP for device health/performance, Syslog for log messages, NetFlow for traffic analysis/bandwidth, SIEM for security correlation across multiple sources.
Key Terms
Key Terms
Knowledge Check — 12 Questions
Network Operations — Monitoring
Which SNMP operation sends an unsolicited alert from the agent to the NMS?
- GET
- SET
- TRAP
- GETNEXT
Answer: TRAP
TRAP is an unsolicited notification from the SNMP agent to the NMS when a significant event occurs.
Syslog uses which default transport and port?
- TCP 514
- UDP 514
- TCP 162
- UDP 162
Answer: UDP 514
Standard syslog uses UDP port 514. Encrypted syslog (TLS) uses TCP 6514.
NetFlow collects which type of data?
- Full packet captures
- Flow metadata (5-tuple: src/dst IP, src/dst port, protocol)
- SNMP MIB variables
- Syslog messages
Answer: Flow metadata (5-tuple: src/dst IP, src/dst port, protocol)
NetFlow captures flow statistics — not packet content. A flow is identified by the 5-tuple.
Which tool is best for correlating security events from multiple sources?
- SNMP
- NetFlow
- Syslog server
- SIEM
Answer: SIEM
A SIEM aggregates logs from all sources and applies correlation rules to detect security incidents.
A network baseline is used to:
- Configure device passwords
- Document normal behavior so anomalies can be detected
- Assign IP addresses
- Test cable continuity
- Answer: Document normal behavior so anomalies can be detected
A baseline records normal traffic patterns — deviations indicate potential problems or attacks.
Which SNMPv3 security level provides authentication but no encryption?
- noAuthNoPriv
- authNoPriv
- authPriv
- privNoAuth
Answer: authNoPriv
authNoPriv authenticates the user (MD5/SHA) but does not encrypt the SNMP payload.
NTP synchronization is important for syslog because timestamps must be accurate for log correlation.
- True
- False
Answer: True
Without synchronized clocks, correlating events across devices is impossible — timestamps from different devices will not align.
IPFIX is best described as:
- A Cisco-proprietary flow protocol
- The IETF standardization of NetFlow v9
- A syslog replacement
- An SNMP extension
- Answer: The IETF standardization of NetFlow v9
IPFIX (IP Flow Information Export) is the IETF standard based on NetFlow v9 — template-based and vendor-neutral.
Which syslog severity level indicates a warning condition?
- 2
- 3
- 4
- 5
Answer: 4
Severity 4 = Warning. Levels 0–3 are more severe (Emergency through Error); 5–7 are less severe.
The MIB in SNMP is:
- A network management station
- A hierarchical database of variables the agent exposes
- A type of SNMP trap
- A syslog facility
- Answer: A hierarchical database of variables the agent exposes
The MIB (Management Information Base) defines all variables an SNMP agent can report — CPU, interface stats, error counters, etc.
Which monitoring tool is best for identifying the top bandwidth consumers on a network?
- Syslog
- SNMP traps
- NetFlow
- Ping
Answer: NetFlow
NetFlow provides per-flow traffic statistics — ideal for identifying top talkers and bandwidth usage by application.
An SNMP INFORM differs from a TRAP in that the NMS sends an _____ to confirm receipt.
Answer: acknowledgment
INFORM messages require an acknowledgment from the NMS — if none is received, the agent retransmits. TRAPs are fire-and-forget.
Previous lesson: WAN technologies: MPLS, SD-WAN, broadband, leased lines, cellular, satellite
Back to CompTIA Network+ Preparation
Next lesson: Network documentation: diagrams, IP schema, change management, disaster recovery