Network Monitoring Review of Software
Components Network Discovery Availability monitoring Alerting system Service Monitoring Network Performance Asset Control Version Control Configuration Management Host tracking Behaviour analysis
Network Discovery Vital Features Selectivity Can t t see the wood for the trees! Speed Network kit often in huge private ranges Method of automatically getting results out
Network Discovery Netdisco Free network discovery package using CDP SNMP CDP neighbour script
Availability Monitoring Scriptable configuration Hierarchy of the network Notification schedule by time Notification schedule by severity Notification methods SMS, email etc Multiple views Historical record
Availability Monitoring Packages Nagios OpenNMS Zabbix Zenoss NAV etc Most commercial software NOT configurable from scripts
Service monitoring Scriptable configuration More than just connect to port Many different protocols Alert scheduling by time, group and severity as availability monitoring
Service Monitoring Packages Tests port function Netcrunch OpManager Port up only Nagios OpenNMS Zabbix Zenoss
Network Performance - Vital Features Scriptable configuration Template system Scalability Scalability (25,000 SNMP parameters for Bangor) Reliability Long term support Long term storage Data preservation across upgrades Data averaging? Thresholds and Automated warnings
Network Performance Measurement Most MRTG inspired or RRDTool based systems sample at interval and then progressively average. Hourly (1 minute average) Daily (5 minute average) Weekly (30 minute average) Monthly (2 hour average) Yearly (1 day average Little storage required. Predefined quantity of storage required.
The effect of averaging Effect of Averaging Data Rate 9e+08 8e+08 5 seconds 30 seconds 5 minutes 30 minute 2 hour 1 day 7e+08 Data rate in Bits/Second (1Gb/s = 1e+09) 6e+08 5e+08 4e+08 3e+08 2e+08 1e+08 0 0 20000 40000 60000 80000 100000 120000 140000 Time in Seconds
Network Performance - Storage RRDTool RRDTool defaults mimic MRTG. Most other packages take those defaults. Cacti Cricket (NAV) OpenNMS Zenoss
Network Performance - Storage MRTG style RRD Advantages Very limited storage required No data growth No maintenance required MRTG style RRD Disadvantages Useless for capacity planning Rapidly loses resolution Graphs cannot be directly compared
Network Performance - Storage Sample @ 5 sec Quantise to nearest % load Count occurrences of % load for period Plot as mesh Frequency 180 160 140 120 100 80 60 40 20 0 Network Load - Time Series line 1 0 0.2 0.4 0.6 Fraction of maximum load 0.8 1 160000 140000 120000 100000 80000 60000 Time in Seconds 40000 20000 0
Network Performance - Storage Advantages Graphs comparable even when count period and quantise level different Low data storage requirements Disadvantages Nobody does it!
Network Performance - Storage Products that meet requirements Statseeker Samples @ 1/min, averaged to 1/5min after 1 year Very efficient Configurable thresholds RTG With sufficient effort should deliver Thresholds should be quite easy to code Cacti Theoretically need not do MRTG averaging No thresholds Free, easy to use, produces pleasing graphs
Asset Control Automatic device tracking Permanent link between serial number and purchasing details Able to deal with multiple owners Able to deal with parts of chassis switches individually
Asset control NAV Database design sufficient Front end more limited? OpenNMS Database design seems inadequate
Version Control Scriptable configuration Automatic Easy identification of devices needing upgrade Version history
Configuration Management Scriptable configuration Save running configuration Run scripted commands Alert on configuration change Save configuration history Alert on improperly configured devices Use templates & central config generation
Configuration Management RANCID Uses CVS or subversion Config backup and change detection No templating Cheetah Templating software
Host Tracking Scriptable configuration Locate host by IP or MAC address Location history
Host tracking With historical record NAV On the fly only Netdisco Netcrunch
Behaviour Analysis Mirroring port Using netflow or sflow data Mirroring methods need lots of CPU Aims IDS User behaviour analysis and control Improving efficiency on expensive links
Behaviour Analysis Specialist packages Snort mirroring InMon sflow Argus free Ntop free commercial netflow/sflow/mirroring mirroring free
Cacti RRDTool based Graphing package CLI and API (API docs?) Scalable
Cacti features Graph Hierarchy Difficult to configure from the command line User management Any OIDs Graphical management Efficient poll Free!
RDT Fast SNMP data collection Storage in SQL database Not really a complete solution even for performance monitoring but a good basis?
Statseeker Network performance Some availability functions Not free Scales easily to University size networks Only software to meet most of our network performance specification Used by many Universities including us! Highly recommended Version 3 now out
Netcrunch Service based lots of predefined services Intelligent ping not just port in Logical map graphical mapping Manual physical views Performance monitoring can be configured - not designed to be run by default on all ports. Servers performance monitoring through SNMP
NetCrunch Cannot do everything from web, but all monitoring except traffic 2-33 days consultancy on installation XE unlimited 11,500 down to 4,000 smallest limited version 3,690 software maintenance major and minor updates & telephone support Central behaviour analysis solution - Netfort 25,000
NAV Database centred framework Used by all Norwegian Universities Good documentation Database design documented etc Designed for Universities Free
NAV Availability monitoring Alerting system Service Monitoring? Network Performance - cricket Asset Control Version Control Host tracking Weathermap
NAV But Performance monitoring is poor (cricket) Can be difficult to install best on debian Mailing list traffic low
Open NMS Service monitoring Availability monitoring Performance monitoring Some asset tracking Buggy and unpredictable Primarily service monitoring rest seems to be an afterthought
Zabbix Availability Performance monitoring Service monitoring Difficult to get started Does not seem to excel at anything
Zenoss Commercial backed Service monitoring Availability monitoring Some performance Buggy and erratic
OpManager Availability monitoring Advanced service monitoring Cheapish commercial product Asset control extra Poor performance monitoring
NTop Free Network monitoring behaviour analysis Easy to install Pretty graphical output Easy to understand
Behaviour Analysis Network Discovery Host Tracking Host Tracking Configuration management Version Control Version Control Asset Control Asset Control Network Performance Service Monitoring Availability Monitoring Cacti Zabbix Open NMS? NAV Rancid Snort
Bangor University s s Choices Netdisco or in-house SNMP CDP script Network discovery Nagios Availability Service monitoring Statseeker Network performance
Bangor University s s Choices NAV Core database for network management Asset control Host tracking Availability? Version control? RANCID Configuration management Cheetah Configuration templating Snort/Ntop Behaviour analysis
Any questions or observations?????