Network Monitoring. Review of Software

Transcription

1 Network Monitoring Review of Software

2 Components Network Discovery Availability monitoring Alerting system Service Monitoring Network Performance Asset Control Version Control Configuration Management Host tracking Behaviour analysis

3 Network Discovery Vital Features Selectivity Can t t see the wood for the trees! Speed Network kit often in huge private ranges Method of automatically getting results out

4 Network Discovery Netdisco Free network discovery package using CDP SNMP CDP neighbour script

5 Availability Monitoring Scriptable configuration Hierarchy of the network Notification schedule by time Notification schedule by severity Notification methods SMS, etc Multiple views Historical record

6 Availability Monitoring Packages Nagios OpenNMS Zabbix Zenoss NAV etc Most commercial software NOT configurable from scripts

7 Service monitoring Scriptable configuration More than just connect to port Many different protocols Alert scheduling by time, group and severity as availability monitoring

8 Service Monitoring Packages Tests port function Netcrunch OpManager Port up only Nagios OpenNMS Zabbix Zenoss

9 Network Performance - Vital Features Scriptable configuration Template system Scalability Scalability (25,000 SNMP parameters for Bangor) Reliability Long term support Long term storage Data preservation across upgrades Data averaging? Thresholds and Automated warnings

10 Network Performance Measurement Most MRTG inspired or RRDTool based systems sample at interval and then progressively average. Hourly (1 minute average) Daily (5 minute average) Weekly (30 minute average) Monthly (2 hour average) Yearly (1 day average Little storage required. Predefined quantity of storage required.

11 The effect of averaging Effect of Averaging Data Rate 9e+08 8e+08 5 seconds 30 seconds 5 minutes 30 minute 2 hour 1 day 7e+08 Data rate in Bits/Second (1Gb/s = 1e+09) 6e+08 5e+08 4e+08 3e+08 2e+08 1e Time in Seconds

12 Network Performance - Storage RRDTool RRDTool defaults mimic MRTG. Most other packages take those defaults. Cacti Cricket (NAV) OpenNMS Zenoss

13 Network Performance - Storage MRTG style RRD Advantages Very limited storage required No data growth No maintenance required MRTG style RRD Disadvantages Useless for capacity planning Rapidly loses resolution Graphs cannot be directly compared

14 Network Performance - Storage 5 sec Quantise to nearest % load Count occurrences of % load for period Plot as mesh Frequency Network Load - Time Series line Fraction of maximum load Time in Seconds

15 Network Performance - Storage Advantages Graphs comparable even when count period and quantise level different Low data storage requirements Disadvantages Nobody does it!

16 Network Performance - Storage Products that meet requirements Statseeker 1/min, averaged to 1/5min after 1 year Very efficient Configurable thresholds RTG With sufficient effort should deliver Thresholds should be quite easy to code Cacti Theoretically need not do MRTG averaging No thresholds Free, easy to use, produces pleasing graphs

17 Asset Control Automatic device tracking Permanent link between serial number and purchasing details Able to deal with multiple owners Able to deal with parts of chassis switches individually

18 Asset control NAV Database design sufficient Front end more limited? OpenNMS Database design seems inadequate

19 Version Control Scriptable configuration Automatic Easy identification of devices needing upgrade Version history

20 Configuration Management Scriptable configuration Save running configuration Run scripted commands Alert on configuration change Save configuration history Alert on improperly configured devices Use templates & central config generation

21 Configuration Management RANCID Uses CVS or subversion Config backup and change detection No templating Cheetah Templating software

22 Host Tracking Scriptable configuration Locate host by IP or MAC address Location history

23 Host tracking With historical record NAV On the fly only Netdisco Netcrunch

24 Behaviour Analysis Mirroring port Using netflow or sflow data Mirroring methods need lots of CPU Aims IDS User behaviour analysis and control Improving efficiency on expensive links

25 Behaviour Analysis Specialist packages Snort mirroring InMon sflow Argus free Ntop free commercial netflow/sflow/mirroring mirroring free

26 Cacti RRDTool based Graphing package CLI and API (API docs?) Scalable

27 Cacti features Graph Hierarchy Difficult to configure from the command line User management Any OIDs Graphical management Efficient poll Free!

28 RDT Fast SNMP data collection Storage in SQL database Not really a complete solution even for performance monitoring but a good basis?

29 Statseeker Network performance Some availability functions Not free Scales easily to University size networks Only software to meet most of our network performance specification Used by many Universities including us! Highly recommended Version 3 now out

30 Netcrunch Service based lots of predefined services Intelligent ping not just port in Logical map graphical mapping Manual physical views Performance monitoring can be configured - not designed to be run by default on all ports. Servers performance monitoring through SNMP

31 NetCrunch Cannot do everything from web, but all monitoring except traffic 2-33 days consultancy on installation XE unlimited 11,500 down to 4,000 smallest limited version 3,690 software maintenance major and minor updates & telephone support Central behaviour analysis solution - Netfort 25,000

32 NAV Database centred framework Used by all Norwegian Universities Good documentation Database design documented etc Designed for Universities Free

33 NAV Availability monitoring Alerting system Service Monitoring? Network Performance - cricket Asset Control Version Control Host tracking Weathermap

34 NAV But Performance monitoring is poor (cricket) Can be difficult to install best on debian Mailing list traffic low

35 Open NMS Service monitoring Availability monitoring Performance monitoring Some asset tracking Buggy and unpredictable Primarily service monitoring rest seems to be an afterthought

36 Zabbix Availability Performance monitoring Service monitoring Difficult to get started Does not seem to excel at anything

37 Zenoss Commercial backed Service monitoring Availability monitoring Some performance Buggy and erratic

38 OpManager Availability monitoring Advanced service monitoring Cheapish commercial product Asset control extra Poor performance monitoring

39 NTop Free Network monitoring behaviour analysis Easy to install Pretty graphical output Easy to understand

40 Behaviour Analysis Network Discovery Host Tracking Host Tracking Configuration management Version Control Version Control Asset Control Asset Control Network Performance Service Monitoring Availability Monitoring Cacti Zabbix Open NMS? NAV Rancid Snort

41 Bangor University s s Choices Netdisco or in-house SNMP CDP script Network discovery Nagios Availability Service monitoring Statseeker Network performance

42 Bangor University s s Choices NAV Core database for network management Asset control Host tracking Availability? Version control? RANCID Configuration management Cheetah Configuration templating Snort/Ntop Behaviour analysis

43 Any questions or observations?????