FCAPS — The Five Buckets of Network Management

20 min In Progress

Learning Objectives

  • Name and describe each FCAPS bucket with a concrete example
  • Map a real-world network event to the correct bucket
  • Build a simulated device-state object and classify actions against it

What Network Management Actually Means

Network management is the ongoing work of keeping network devices (routers, switches, firewalls, access points) up, fast, correctly configured, and secure. That's a broad mandate, so the industry organized it into five categories called FCAPS — each one a distinct type of work with its own tools and metrics. FCAPS stands for: Fault, Configuration, Accounting, Performance, and Security.

The Five Buckets

Fault — detect and fix problems. A switch port flapping up/down, a link going dark, a device going offline. Tools: syslog, SNMP traps, netflow anomaly detection. Configuration — keep device settings correct and consistent. Pushing the same NTP server to 200 routers. Tools: Ansible, NAPALM, Netmiko. Accounting — track who used the network, how much, and when. Bandwidth billing, department usage reports, audit trails. Tools: NetFlow, IPFIX, RADIUS accounting. Performance — keep it fast. Measure latency, packet loss, throughput, and intervene before users notice degradation. Tools: IP SLA, MRTG, Grafana. Security — keep it safe. ACLs, AAA, encrypted management traffic, patch management, anomaly detection. Tools: IDS/IPS, ACLs, 802.1X.

fcaps = {
    'fault':         'detect/fix outages and failures',
    'configuration': 'keep device settings correct',
    'accounting':    'track usage and audit trails',
    'performance':   'measure and maintain speed/quality',
    'security':      'protect against unauthorized access',
}

events = [
    ('Switch port Gi0/1 flapping',          'fault'),
    ('Pushing NTP server to 50 routers',    'configuration'),
    ('Latency to DC spiked from 2ms to 80ms', 'performance'),
    ('Dept A used 40GB this month',         'accounting'),
    ('Brute-force login attempt detected',  'security'),
]

for event, bucket in events:
    print(f'{bucket.upper():14} | {event}')

The 5-Step Automation Workflow

Across every tool in network automation, the same five steps repeat: Inventory (know your devices), Connect (SSH/API), Execute (send commands), Parse (turn text into data), Act (make a decision — save, alert, rollback, or push a change).

class network_device:
    def __init__(self, hostname, ip, role, running_config):
        self.hostname = hostname
        self.ip = ip
        self.role = role
        self.running_config = running_config

    def has_line(self, config_line):
        return config_line in self.running_config


# Step 1 — Inventory
inventory = [
    network_device('edge-router-1', '192.168.1.1', 'router',
                   ['ip ssh version 2', 'ntp server 10.0.0.1']),
    network_device('core-switch-1', '192.168.1.2', 'switch',
                   ['ip ssh version 2']),
    network_device('access-switch-1', '192.168.1.3', 'switch',
                   []),
]

required = 'ntp server 10.0.0.1'

for device in inventory:
    # Step 2: Connect (simulated — real code would use Netmiko here)
    # Step 3: Execute (has_line simulates 'show run | include ntp')
    found = device.has_line(required)
    # Step 4: Parse (bool result)
    status = 'OK' if found else 'MISSING'
    # Step 5: Act
    print(f'{device.hostname:20} {device.ip:15} {status}')

📝 Exercise: FCAPS Classifier

Extend the network_device class with an fcaps_audit() method that checks for three config lines (one per FCAPS category: ntp for configuration, ip ssh for security, logging for fault) and returns a dict mapping each category to 'PASS' or 'FAIL'. Run it against the three devices in the inventory.

code.py
Output

            

        

    


    

        ← Back to Chapter