Network Monitoring

---
name: network-monitoring
description: "Cross-platform comparison and architecture guidance for all network monitoring and observability technologies: SNMP polling, flow analytics, synthetic monitoring, golden signals, alerting strategies, and platform selection. Use for \"network monitoring comparison\", \"NMS selection\", \"SNMP monitoring\", \"flow analytics\", \"synthetic monitoring\", \"monitoring architecture\", \"alerting strategy\", \"network observability\". Do NOT use for solarwinds-npm-, thousandeyes-, kentik-, librenms-, or prtg-specific configuration -- use that technology's own skill. Do NOT use for general infrastructure/APM/log observability (Prometheus, Grafana, Datadog, ELK) -- that is the monitoring plugin."
license: MIT
---

# Network Monitoring

This skill covers all network monitoring and observability technologies, providing cross-platform expertise in SNMP-based device monitoring, flow-based traffic analytics, synthetic monitoring, alerting design, and platform selection. Sibling technology skills provide deep implementation details.

## When to Use This Skill vs. a Technology Skill

**Use this skill when the question is cross-platform or architectural:**
- "Which NMS should I deploy for 5,000 devices?"
- "How do I design an alerting strategy that reduces noise?"
- "Compare SolarWinds NPM vs LibreNMS for our environment"
- "What monitoring stack should I use for a hybrid cloud network?"
- "SNMP vs flow analytics vs synthetic -- which do I need?"
- "How do I implement golden signals for network monitoring?"

**Route to a technology skill when the question is platform-specific:**
- "Configure NetPath in SolarWinds NPM" --> the `solarwinds-npm` skill
- "Deploy ThousandEyes Enterprise Agent on Cisco SD-WAN" --> the `thousandeyes` skill
- "Set up Kentik flow ingestion from AWS VPC" --> the `kentik` skill
- "LibreNMS auto-discovery not finding devices" --> the `librenms` skill
- "PRTG sensor count optimization" --> the `prtg` skill

## How to Approach Tasks

1. **Classify** the request:
   - **Platform selection** -- Load `references/concepts.md` for fundamentals, then compare platforms
   - **Architecture / Design** -- Apply monitoring strategy, data collection tiers, alerting hierarchy
   - **Troubleshooting** -- Identify the platform, consult the technology skill
   - **Alerting design** -- Apply golden signals, threshold vs. baseline, escalation patterns
   - **Capacity planning** -- Polling intervals, data retention, SNMP scale limits

2. **Gather context** -- Network size (device count), existing infrastructure, team expertise, budget, compliance requirements, monitoring gaps

3. **Analyze** -- Apply monitoring-specific reasoning. Consider: what data is needed (device health vs. traffic analysis vs. user experience), where to collect it, how to alert on it.

4. **Recommend** -- Provide platform-specific guidance with trade-offs

5. **Qualify** -- State assumptions about scale, network architecture, and operational maturity

## Monitoring Paradigms

### 1. SNMP Polling (Device Health)
Traditional NMS approach. Poll devices at regular intervals for:
- Interface utilization, errors, discards
- CPU, memory, temperature
- Availability (up/down)
- Custom OIDs for vendor-specific metrics

**Best for:** Infrastructure health monitoring, availability tracking, capacity planning.
**Platforms:** SolarWinds NPM, LibreNMS, PRTG, Zabbix, Nagios.

### 2. Flow Analytics (Traffic Analysis)
Analyze network traffic at the flow level:
- NetFlow v5/v9, IPFIX, sFlow, VPC Flow Logs
- Source/destination, application, volume, patterns
- Anomaly detection, DDoS identification
- Capacity planning by application and destination

**Best for:** Traffic analysis, bandwidth planning, security investigation, DDoS detection.
**Platforms:** Kentik, SolarWinds NTA, Plixer Scrutinizer, ntopng, Elastiflow.

### 3. Synthetic Monitoring (User Experience)
Active probes that simulate user transactions:
- HTTP/HTTPS availability and performance
- DNS resolution time and correctness
- Network path analysis (hop-by-hop)
- Web transaction scripting
- BGP route visibility

**Best for:** SaaS/cloud application monitoring, ISP performance, end-user experience.
**Platforms:** ThousandEyes, Catchpoint, Datadog Synthetics, Kentik Synthetics.

### 4. Packet Capture (Deep Inspection)
Full or sampled packet capture for forensic analysis:
- Protocol analysis and troubleshooting
- Application performance metrics (TCP retransmits, latency)
- Security forensics

**Best for:** Troubleshooting complex issues, security investigation, compliance.
**Platforms:** Wireshark, ExtraHop, Gigamon.

## Golden Signals for Network Monitoring

Adapted from Google's SRE golden signals:

| Signal | Network Meaning | How to Measure |
|---|---|---|
| **Latency** | Round-trip time, path delay | ICMP, synthetic tests, flow timestamps |
| **Traffic** | Bandwidth utilization, flow volume | SNMP interface counters, flow analytics |
| **Errors** | Interface errors, discards, CRC, resets | SNMP error counters, syslog events |
| **Saturation** | CPU/memory/buffer utilization, queue depth | SNMP device metrics, flow-based congestion signals |

**Additional network signals:**
- **Availability** -- Device/interface up/down state (SNMP, ICMP)
- **Jitter** -- Variation in latency (synthetic probes, RTP monitoring)
- **Packet Loss** -- End-to-end loss rate (synthetic probes, flow analytics)
- **Path Changes** -- Routing/forwarding path modifications (BGP monitoring, traceroute)

## Alerting Design

### Threshold Types
1. **Static threshold** -- Fixed value (e.g., CPU > 90%). Simple but generates noise during maintenance or known peaks.
2. **Baseline deviation** -- Alert when metric deviates from learned normal pattern (e.g., 2 standard deviations above average for this time of day). Fewer false positives.
3. **Rate of change** -- Alert when metric changes rapidly (e.g., interface utilization jumps 50% in 5 minutes). Catches sudden failures.
4. **Composite / Multi-condition** -- Require multiple conditions (e.g., CPU > 80% AND memory > 90% AND for > 10 minutes). Reduces noise.

### Severity Levels
| Level | Meaning | Response |
|---|---|---|
| Critical | Service-impacting; immediate action | Page on-call engineer |
| Warning | Approaching threshold; proactive action | Email/Slack notification |
| Informational | Notable event; no action | Dashboard, log |

### Alert Fatigue Mitigation
- **Deduplication** -- Suppress duplicate alerts for the same issue
- **Dampening** -- Require condition to persist for N minutes before alerting
- **Correlation** -- Group related alerts (e.g., router down -> all interfaces on that router down)
- **Maintenance windows** -- Suppress alerts during scheduled maintenance
- **Escalation** -- Only escalate if not acknowledged within defined time
- **Actionable alerts only** -- Every alert should have a documented response procedure

## Platform Comparison

### SolarWinds NPM
**Type:** On-premises enterprise NMS
**Strengths:** Comprehensive SNMP monitoring, SQL-backed, NetPath, PerfStack correlation, large module ecosystem
**Considerations:** High cost (per-module licensing), Windows/IIS/SQL dependency, complex deployment
**Best for:** Mid-to-large enterprises with on-premises infrastructure and dedicated monitoring teams

### ThousandEyes
**Type:** SaaS synthetic monitoring + internet intelligence
**Strengths:** Global cloud agent network, path visualization, Internet Insights outage detection, Cisco SD-WAN integration
**Considerations:** High cost (consumption-based), no SNMP/device monitoring, focused on connectivity and SaaS
**Best for:** Organizations relying on SaaS/cloud apps, multi-ISP environments, Cisco SD-WAN shops

### Kentik
**Type:** SaaS flow analytics + BGP + synthetic
**Strengths:** Massive-scale flow analytics, BGP monitoring, DDoS detection, AI insights, natural language queries
**Considerations:** High cost (enterprise pricing), flow-centric (limited SNMP), focused on traffic analysis
**Best for:** Service providers, large enterprises with heavy traffic analysis needs, DDoS-sensitive environments

### LibreNMS
**Type:** Open-source self-hosted NMS
**Strengths:** Free, 10,000+ device definitions, auto-discovery, Oxidized config backup, Grafana integration, distributed polling
**Considerations:** Self-managed (hosting, updates, scaling), community support, no commercial SLA without third-party
**Best for:** Budget-conscious organizations, homelab to mid-enterprise, teams comfortable with self-hosted open source

### PRTG
**Type:** On-premises + SaaS NMS (sensor-based licensing)
**Strengths:** Free 100-sensor tier, auto-discovery, visual maps, easy setup, sensor-based pricing is predictable
**Considerations:** Windows-based (on-premises), sensor count can grow quickly, limited flow analytics
**Best for:** SMB to mid-market, organizations wanting quick deployment with predictable costs

## Monitoring Architecture Design

### Single-Site Pattern
```
[Devices] --> SNMP/ICMP --> [NMS Server]
[Routers] --> NetFlow/sFlow --> [Flow Collector]
[NMS Server] --> Alerts --> [Notification Channels]
```

### Multi-Site with Distributed Polling
```
[Site A Devices] --> [Remote Poller A] --HTTPS--> [Central NMS]
[Site B Devices] --> [Remote Poller B] --HTTPS--> [Central NMS]
[Central NMS] --> Dashboards, Alerts, Reports
```

### Hybrid Cloud Pattern
```
[On-Prem Devices] --> SNMP --> [NMS (on-prem)]
[Cloud VPCs] --> VPC Flow Logs --> [Flow Platform (SaaS)]
[SaaS Apps] --> Synthetic Tests --> [Synthetic Platform (SaaS)]
[All Platforms] --> Unified Dashboard / Alert Aggregation
```

## Data Collection Best Practices

- **SNMP polling interval**: 5 minutes for capacity metrics, 60 seconds for availability, 15-30 seconds for real-time dashboards (use sparingly)
- **Flow sampling**: Full flow for smaller networks; sampled (1:1000 to 1:4096) for high-volume cores
- **Synthetic test frequency**: 1-5 minutes for critical services, 15-30 minutes for standard
- **Log retention**: 30-90 days hot storage, 1-2 years archive for compliance
- **SNMP version**: SNMPv3 with authentication and encryption for production; v2c acceptable for isolated management networks

## Technology Routing

| Request Pattern | Route To |
|---|---|
| SolarWinds, NPM, Orion, NetPath, PerfStack, NTA, SAM | the `solarwinds-npm` skill |
| ThousandEyes, path visualization, Internet Insights, Cloud Agent, synthetic test | the `thousandeyes` skill |
| Kentik, flow analytics, BGP monitoring, DDoS detection, AI insights | the `kentik` skill |
| LibreNMS, Oxidized, auto-discovery, open-source NMS, distributed polling | the `librenms` skill |
| PRTG, sensor, Paessler, PRTG Hosted Monitor, remote probe | the `prtg` skill |

## Reference Files

- `references/concepts.md` -- Monitoring fundamentals: SNMP internals, flow protocol details, synthetic testing, golden signals, alerting theory. Read for "how does X work" or cross-platform architecture questions.