Network Monitoring Definition and Solutions

Editor’s Note: This article was updated June 5, 2009.

• What is network monitoring?
• How important is network monitoring?
• What can network monitoring systems monitor?
• What kind of networks can they monitor?
• What strategic tasks can network monitoring systems do?
• What questions can network monitoring answer?
• What can network monitoring do for me?
• What tools will I find in network monitoring systems?
• What kinds of network monitoring systems are available?
• What do they cost?

What is network monitoring?

Network monitoring for a corporate network is a critical IT function that can save money in network performance, employee productivity and infrastructure cost overruns. A network monitoring system monitors an internal network for problems. It can find and help resolve snail-paced webpage downloads, lost-in-space e-mail, questionable user activity and file delivery caused by overloaded, crashed servers, dicey network connections or other devices.

Network monitoring systems (NMSs) are much different from intrusion detection systems (IDSs) or intrusion prevention systems (IPSs). These other systems detect break-ins and prevent scurrilous activity from unauthorized users. An NMS lets you know how well the network is running during the course of ordinary operations; its focus isn’t on security per se.

Network monitoring can be achieved using various software or a combination of plug-and-play hardware and software appliance solutions. Virtually any kind of network can be monitored. It doesn’t matter whether it’s wireless or wired, a corporate LAN, VPN or service provider WAN. You can monitor devices on different operating systems with a multitude of functions, ranging from BlackBerrys and cell phones, to servers, routers and switches. These systems can help you identify specific activities and performance metrics, producing results that enable a business to address various and sundry needs, including meeting compliance requirements, stomping out internal security threats and providing more operational visibility.

Deciding specifically what to monitor on your network is as important as giving network monitoring a general thumbs up. You must be sure that your corporate network topology map is up to date. That map should accurately lay out the different types of networks to be monitored, which servers are running which applications on which operating system, how many desktops need to be counted into the mix and what kind of remote devices have access for each network. A dose of clarity at the outset makes choosing which monitoring tools to purchase down the line somewhat simpler.

• What is network monitoring?
• How important is network monitoring?
• What can network monitoring systems monitor?
• What kind of networks can they monitor?
• What strategic tasks can network monitoring systems do?
• What questions can network monitoring answer?
• What can network monitoring do for me?
• What tools will I find in network monitoring systems?
• What kinds of network monitoring systems are available?
• What do they cost?

How important is network monitoring?

You might think that if the network is up and running, there is no reason to mess with it. Why should you care about adding another project for your network managers to scribble across their whiteboards, already crammed floor-to-ceiling? The reasons to insist on network monitoring can be summarized on a high level into maintaining the network’s current health, ensuring availability and improving performance. An NMS also can help you build a database of critical information that you can use to plan for future growth.

Network monitoring is like a visit to a cardiologist. You’re combining experience, judgment and technology to chart a system’s performance.

Your doctor is watching for danger signs as blood flows through vessels, valves and chambers of the heart, while your network monitoring systems are tracking data moving along cables and through servers, switches, connections and routers.

That analogy holds up especially when you consider how important real-time information is in both cases.

Of course, network monitoring differs in that smart companies don’t settle for annual snapshots of system performance. Nor do they monitor only after the appearance of disturbing symptoms. They monitor their networks 24 hours a day, every day.

• What is network monitoring?
• How important is network monitoring?
• What can network monitoring systems monitor?
• What kind of networks can they monitor?
• What strategic tasks can network monitoring systems do?
• What questions can network monitoring answer?
• What can network monitoring do for me?
• What tools will I find in network monitoring systems?
• What kinds of network monitoring systems are available?
• What do they cost?

What can network monitoring systems monitor?

Network monitoring won’t help unless you track the right things. The usual areas examined are bandwidth usage, application performance and server performance.

Monitoring traffic is a fundamental task, one on which all other network-building and -maintenance tasks are based. It generally focuses on resources that support internal end users. So network monitoring systems have evolved to oversee an assortment of devices:

• BlackBerrys

• Cell phones

• Servers and desktops

• Routers

• Switches

Some network monitoring systems come with automatic discovery, which is the ability to continuously record devices as they’re added, removed or undergo configuration changes. These tools segregate devices dynamically. Some common rubrics are:

• IP address

• Service

• Type (switch, router, etc.)

• Physical location

Beyond the obvious advantage of knowing exactly — and in real time — what you have deployed, automatic discovery and categorization of segments helps you plan for growth. Underused hardware can take on new functions, for example. They also help pinpoint problems. If all devices at a given location are underperforming, there might be a resource-management problem to address.

• What is network monitoring?
• How important is network monitoring?
• What can network monitoring systems monitor?
• What kind of networks can they monitor?
• What strategic tasks can network monitoring systems do?
• What questions can network monitoring answer?
• What can network monitoring do for me?
• What tools will I find in network monitoring systems?
• What kinds of network monitoring systems are available?
• What do they cost?

What kind of networks can they monitor?

By the same token, large networks often are networks of disparate networks. Segments can differ by vendor, generation, mission and other factors. Here, too, monitoring tools can make sense of the complexity.

Some common network types are:

• Wireless or wired

• A corporate local-area network (LAN)

• A virtual private network (VPN)

• A service provider’s wide-area network (WAN)

If all those variables weren’t enough, business markets are always demanding new site functions for internal and external use. Performance-sensitive functions (otherwise known as bandwidth hogs) include voice over IP (VoIP), Internet Protocol TV (IPTV) and video on demand (VOD). Monitoring enables managers to allocate resources to maintain system integrity.

• What is network monitoring?
• How important is network monitoring?
• What can network monitoring systems monitor?
• What kind of networks can they monitor?
• What strategic tasks can network monitoring systems do?
• What questions can network monitoring answer?
• What can network monitoring do for me?
• What tools will I find in network monitoring systems?
• What kinds of network monitoring systems are available?
• What do they cost?

What strategic tasks can network monitoring systems do?

A network monitoring system (NMS) will help make sense of these complex environments, issuing reports that managers use to:

• Confirm regulatory and policy compliance

• Highlight potential cost savings by finding redundant resources, for example

• Solve efficiency-sapping mysteries like dropped mail sessions

• Help determine employee productivity

• Spot overloaded equipment before it can bring down a network

• Identify weak wide-area-network links and other bottlenecks

• Measure latency, or the delayed transfer of data

• Find anomalous internal traffic that might be indicate a security threat

But an NMS isn’t an intrusion detection system (IDS) or intrusion prevention system (IPS). Those critical systems detect break-ins and prevent unauthorized activity. An NMS can detect troublesome actions, but that is not its mission.

It’s also not a “set it and forget it” solution.

• What is network monitoring?
• How important is network monitoring?
• What can network monitoring systems monitor?
• What kind of networks can they monitor?
• What strategic tasks can network monitoring systems do?
• What questions can network monitoring answer?
• What can network monitoring do for me?
• What tools will I find in network monitoring systems?
• What kinds of network monitoring systems are available?
• What do they cost?

What questions can network monitoring answer?

While an NMS will map your network topology, for instance, it’s up to managers to examine and decide the fate of each piece of the topology. A comprehensive monitoring report will help you answer tough questions:

• Simplicity in the form of homogenous systems can deliver savings, but can segments be replaced at an acceptable cost?

• Which operating systems and apps are on which servers, and are they necessary?

• Who are the power users, and what are they sending?

• How close to capacity are servers?

• What remote devices being used, and what are they being used for?

• How and where are remote devices entering the system?

• Who and what resources are managing the system?

Of course, stocked with this information and clean status reports, a budget-pressured exec might conclude that no problems mean no reason to change things. That’s usually the wrong conclusion because businesses don’t exist in a steady state.

• What is network monitoring?
• How important is network monitoring?
• What can network monitoring systems monitor?
• What kind of networks can they monitor?
• What strategic tasks can network monitoring systems do?
• What questions can network monitoring answer?
• What can network monitoring do for me?
• What tools will I find in network monitoring systems?
• What kinds of network monitoring systems are available?
• What do they cost?

What can network monitoring do for me?

Careful network monitoring gives executives all the ammo they need to justify network upgrades and expansions in order to support new corporate goals. Or to call a vendor on the carpet.

Service-level agreements too often are hard to enforce on the part of client companies because execs have only murky insight into conditions governed by an SLA.

For more on service-level agreements, see The ABCs of SLAs.

An effective NMS will tell managers in clear terms if a given device, service or application is meeting contractually mandated performance levels.

• What is network monitoring?
• How important is network monitoring?
• What can network monitoring systems monitor?
• What kind of networks can they monitor?
• What strategic tasks can network monitoring systems do?
• What questions can network monitoring answer?
• What can network monitoring do for me?
• What tools will I find in network monitoring systems?
• What kinds of network monitoring systems are available?
• What do they cost?

What tools will I find in network monitoring systems?

Network monitoring systems themselves can be software or firmware, simple or complex.

Among the most simple are tools that send signals to devices to see how long it takes for the signal to return — digital echolocation. More relevant to most network managers are tools that ship with common tests and monitoring scripts and that can produce rich reports with graphics that summarize conditions from device-specific to network-wide.

Open-source tools are innovative, inexpensive and numerous. And they work with most tools and platforms.

No matter where you get your tools, though, aggressively investigate how well they will work in your environment, especially with the operating systems on your network.

If your network has become simply too complex and you can’t keep tabs on what’s happening, you can outsource monitoring. Outsourcers create levels of services and packages of functions to cover a wide variety of network environments and budgets.

Network monitoring products can be totally free, as with open-source apps) and they can be extremely expensive. Appliances, software-only solutions and services range from $50 on into five figures.

• What is network monitoring?
• How important is network monitoring?
• What can network monitoring systems monitor?
• What kind of networks can they monitor?
• What strategic tasks can network monitoring systems do?
• What questions can network monitoring answer?
• What can network monitoring do for me?
• What tools will I find in network monitoring systems?
• What kinds of network monitoring systems are available?
• What do they cost?

What kinds of network monitoring systems are available?

Network monitoring tools come in all flavors and levels of complexity. If you’re a lab rat, plenty of Command Line Interface (CLI) tools are available. One example is the venerable Ping, a reliable tool for operating on the “KISS” theory. Ping tests whether a particular host is reachable across an IP network; it works by sending ICMP echo request packets to the target host and listening for echo response replies. Ping estimates the round-trip time in milliseconds, records any packet loss and spits out a summary when finished.

Obviously, there are learning curve issues associated with CLI tools. For those less geek-minded, an abundance of Web-based GUI solutions including detailed reporting and graphical chart features are available. These tools can be easier to set up and use. Many come with pre-scripted configurations. Plus, the charts they produce are very handy when putting together executive presentations for network investment pitches.

Open-source tools, always an IT geek favorite, abound for network monitoring. They’re generally innovative, irreverent but stylish and, best of all, mostly free or cheap. Additionally, open-source monitoring tools are interoperable with almost every other tool or platform. The data from these open-source tools is almost always dumped into XML; even major vendors tend to drink from the XML cup at one stage or another. For example, one tool that was free under the GNU GPL began life as a nondescript little script to graph the use of a university connection to the Internet. It was later used as a tool for graphing other data sources including speed, voltage, temperature and number of printouts. Then network folks began using the software to poll network devices, retrieve MIB (Management Information Base) and SNMP (Simple Network Management Protocol) values, and use Perl scripts to post the results in graphs on webpages. The tool quickly became widely used not only by the open-source folks cobbling their own solutions together but also by very large proprietary vendors who borrowed from some of the tool’s capabilities to enrich their own solutions.

If you’re in the market for new gear, several network equipment manufacturers have developed tools that provide very detailed info for their own devices, adding significant value to the purchase. Be sure to investigate how well those tools interoperate, especially with operating systems on your network, to determine just how helpful the tools will be to your overall plan. It’s entirely too possible to end up duplicating expenses. For instance, you don’t want to find yourself in a situation where you bought new servers with a monitoring tool included for one location and the monitoring tool doesn’t play well with your servers running a different, non-supported operating system at another location.

If you already have a plethora of disparate devices, with varying degrees of inter-working talent and a sizable learning curve, all is not lost. There are monitoring appliances on the market that may be able to fish you out by aggregating and simplifying the management aspects of network monitoring. They accomplish this by managing the traffic to the standalone tools, whether they’re appliances or applications. The appliances provide the option of load-balancing across appliances living on different subnets. Theoretically, the process is more flexible and helps alleviate network bottlenecks caused by multiple monitoring tools, which slow down traffic to inspect it. The learning curve is also lessened, so your network managers aren’t staying up nights with five to six manuals on their bed-stands.

As the network becomes more complex, so must the monitoring system. Converged, or “triple play” networks, combine voice, video and high-speed data transmission over a single pipe. These need real-time performance management and monitoring. This type of network needs a system that examines each packet for jitter, latency and packet loss, and that’s just for starters. The traditional way of managing networks—using SNMP agents to poll network devices every five seconds to determine whether there is a network problem—will not do. There are monitoring solutions available that handle more demanding tasks such as fail-safe operation during a blackout, provide support for mirrored switch ports and VLANs, and niceties like an LCD display for troubleshooting.

If your network has become simply too complex and you can’t keep tabs on what’s happening, other people can do the job for you. There are companies to whom you can outsource your monitoring that provide various monitoring, management and analytical services. For example, one European service provider offers different modules to network customers and to companies using third-party networks. One module’s services include profiling a customer’s network over a specified time frame to identify issues, and producing a performance report on traffic and applications. A different module takes that information and makes recommendations to improve network efficiency. A third module gives ongoing tracking, reporting and performance reports, and another module manages the network against agreed-upon targets.

• What is network monitoring?
• How important is network monitoring?
• What can network monitoring systems monitor?
• What kind of networks can they monitor?
• What strategic tasks can network monitoring systems do?
• What questions can network monitoring answer?
• What can network monitoring do for me?
• What tools will I find in network monitoring systems?
• What kinds of network monitoring systems are available?
• What do they cost?

What do they cost?

Network monitoring solutions can be totally free or they can be extremely expensive. Most open-source tools are free, as are tools that may have been bundled with infrastructure purchases. Appliances, software-only solutions and services range from $50 on into five figures.

With service vendors, you’re likely to be able to choose from a buffet-style menu of monitoring services; these may tally up to a savings over device purchases depending on network priorities. There are other trade-offs. Purchasing services may give you the advantage of rubbing elbows with the latest monitoring technologies; in contrast, purchasing appliances can provide more control.

One thing’s a certainty when it comes to network monitoring. The cost of not using these technologies can be greater than you think, if you’re not getting the performance and availability you’re paying for and if you’re not willing to spend sufficiently to ensure that your network is healthy and secure. What’s it really worth? It could be worth your job.

Additional Reading on CIO.com

• Mobile Tools Blog
• ABC: An Introduction to Mobile Security
• An Introduction to VoIP
• Data Leaks: What You Don’t Know Will Hurt You
• How to Monitor Workers’ Use of IT Without Becoming Big Brother
• How One CIO Escaped E-Mail Attachment Hell
• ABC: An Introduction to Service-Level Agreements (SLAs)
• Five Enterprise Content Monitoring Tools

Kim S. Nash is an award-winning reporter who writes about how the people at big organizations move information to fix critical strategy problems. Sometimes they do it well, sometimes not. Tell her a good business tale here.

Alyson Behr is a Los Angeles, Calif.-based technology journalist and business communications consultant. Formerly director of technical marketing with Spirent Communications, she has served as a product test and reviews contributing editor for InfoWorld and Information Week, and senior contributing editor with Internet Week and SD Times. Behr edited PlanetIT’s networking and advanced IP portals and also served as a judge for several N+I Best of Show and SIIA Codie Awards. She currently covers networking, emerging technologies, and test and measurement issues.