Network monitoring: SNMP, flow data and Prometheus
You build a system that watches devices and links all the time, see who generates how much traffic from flow data, and spot problems before users do with thresholds and alerts.
Level 301 · 16 lessons · 15 practice labs
Lessons
What to monitor
- The goals of network monitoring: availability, capacity, errors
- Availability monitoring: fping and smokeping
- Interface counters: errors, drops, utilisation
- Short task: list the key indicators for critical links
Time-series monitoring
- Collecting metrics with Prometheus
- Monitoring network devices with snmp_exporter
- Service probes with blackbox_exporter
- Grafana dashboards
- Alert rules and cutting the noise
- Short task: alert when link utilisation passes 80 percent
Flow data
- NetFlow and IPFIX: what a flow record is
- Collecting flows with softflowd and nfdump
- Finding the top talkers
- Unusual patterns in flow data
- Short task: find the machine that is filling the link
Wrap-up
- Capstone: a small network operations dashboard with alerts
Practice labs
- Which devices are down?: Sweep the given device list with fping, produce output separating unreachable and high-latency devices and hook it to a job that runs every minute.
- The site is up but the certificate is about to expire: Set up HTTP and TLS probes with blackbox_exporter, query the certificate’s remaining days in Prometheus and point out the target nearing expiry.
- Voice calls break up in the evenings: Set up latency and jitter measurement for Copperleaf Insurance’s branch link, find from several hours of data when and on which link the problem starts and write an evidence-backed report.
- From counters to link utilisation: Read an interface’s byte counters twice to calculate utilisation as a percentage and compare it with load you create using iperf.
- Add the router to Prometheus: Bring the lab router into monitoring with snmp_exporter, query the interface error and discard counters and find the interface whose errors are rising.
- Fake traffic spikes on the graph: Prove that the nonsense spikes on the dashboard come from 32-bit counter wraps and a wrong query, then switch to 64-bit counters and a correct query using rate().
- Alert when the link passes 80 percent: Write a Prometheus rule that fires when interface utilisation stays above 80 percent for a set time, and show it firing by generating load.
- A hundred alerts overnight: Tidy the noisy alert rules with for durations, grouping and inhibition, and show that only meaningful alerts arrive when the same event repeats.
- A small network operations dashboard: Build a Grafana dashboard for Ekin Co-op showing availability, link utilisation and error counters with three linked alerts, then simulate a fault and follow it on the dashboard.
- Who is filling the link?: Collect flow data with softflowd and list with nfdump the five addresses that sent the most bytes in the last half hour along with their ports.
- The backup has drifted into working hours: Find in the flow records the large transfer filling the link during working hours and its source, produce a summary showing the timing and propose a fix.
- An unusual pattern in the flows: Find port-scan and regular-interval outbound beacon patterns in your own lab network’s flow data, extract the relevant flows as evidence and write nfdump filters that would catch them.
- A Prometheus target shows as down: Fix the wrong port and label settings of the job shown as down on the targets page, reload the configuration and show metrics arriving with a query.
- An indicator set for the critical links: Define availability, utilisation, error and latency indicators for Demirhan Machinery’s two critical links and turn each into a working Prometheus query.
- Devices nobody is watching: Write a script comparing the network inventory with the Prometheus targets, find the unmonitored devices and services, add them to monitoring and prove with the same script that no blind spots remain.
About this course
You build a system that watches devices and links all the time, see who generates how much traffic from flow data, and spot problems before users do with thresholds and alerts.
What you will learn
- What to monitor
- Time-series monitoring
- Flow data
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.