Network Performance and Monitoring

Monitoring isn't about collecting every metric — it's about collecting the metrics that matter and knowing what 'normal' looks like. A network that's at 60% utilization might be healthy or critical, depending on the baseline. Without a baseline, every number is noise. With a baseline, every deviation is a signal.

#The Metrics That Matter#link

#Monitoring Tool Categories#link

• ▪SNMP polling — periodic queries for interface counters, CPU, memory, uptime
• ▪SNMP traps — event-driven notifications (interface down, config change)
• ▪Syslog — log messages, correlated across devices
• ▪NetFlow/IPFIX — flow-level visibility into who talks to whom, how much
• ▪IP SLA — synthetic traffic probes measuring latency, jitter, packet loss
• ▪Streaming telemetry — high-frequency, real-time data (modern alternative to SNMP)
• ▪Packet capture — deep inspection when other tools don't tell the story

#NetFlow — the Underused Tool#link

NetFlow gives you flow-level visibility. Instead of 'interface Gi0/1 was at 80% utilization,' you get 'marketing subnet sent 400 GB to the backup server.' The difference is context. When the CFO asks why bandwidth is up 30%, NetFlow tells you which department, which application, which destination.

#Configuring NetFlow on Cisco IOS#link

#IP SLA — Synthetic Monitoring#link

IP SLA generates synthetic traffic to measure specific network behavior. Send ICMP pings every 60 seconds to a specific target; track latency and loss over time. Run a UDP jitter probe for voice-quality measurements. Use HTTP probes to test application reachability. IP SLA results can trigger actions — like failing over to a backup path when latency exceeds a threshold.

On a lab router: configure a NetFlow exporter pointing to a test collector (or use a local analyzer). Configure IP SLA to ping 8.8.8.8 every 60 seconds. Run `show ip sla statistics` after a few minutes. Compare with `show interfaces` counters to see the correlation between synthetic probes and actual traffic.