Monitoring — SNMP, NetFlow & IP SLA

25 min In Progress

Learning Objectives

  • Explain the security difference between SNMPv2c and SNMPv3
  • Describe what NetFlow records and why it matters for blue-team work
  • Use IP SLA to catch performance degradation before users notice

SNMP — Polling Your Devices

SNMP (Simple Network Management Protocol) lets a central server (Zabbix, PRTG, SolarWinds) poll devices for metrics: CPU load, interface traffic, memory use. The server sends a GET request and the device replies with the value. SNMPv2c is easy to configure but sends everything in plain text — including the community string that acts as a password. Anyone on the wire can read it. SNMPv3 adds authentication (SHA) and encryption (AES). More steps to configure, but the only acceptable choice on a real network.

The config blocks above are Cisco IOS syntax — they can't run in Python directly. Displaying them as strings lets you read and study the exact commands.
# Real Cisco IOS config — requires a router, not runnable here
snmpv2c_config = '''
snmp-server community MyReadOnlyString RO
snmp-server location server-room-1
snmp-server contact admin@example.com
'''

snmpv3_config = '''
snmp-server group ADMINGROUP v3 priv
snmp-server user netadmin ADMINGROUP v3
  auth sha MyAuthPass123
  priv aes 128 MyPrivPass123
'''

print('SNMPv2c config lines:')
print(snmpv2c_config)
print('SNMPv3 config lines (auth + encryption):')
print(snmpv3_config)

NetFlow — Who Talked to Who

NetFlow records traffic metadata: source IP, destination IP, port, protocol, bytes, duration — but not the packet content. Think of it like a phone bill: you see who called who and for how long, not what was said. For blue-team work, NetFlow is gold. Anomalous traffic (a workstation suddenly sending data to an unknown external IP at 3am) shows up immediately in NetFlow records even if the session is encrypted.

# Practice: Simulate NetFlow record analysis

flow_records = [
    {'src': '192.168.1.10', 'dst': '8.8.8.8',     'port': 443,  'bytes': 1200,   'hour': 9},
    {'src': '192.168.1.10', 'dst': '8.8.8.8',     'port': 443,  'bytes': 3400,   'hour': 10},
    {'src': '192.168.1.22', 'dst': '45.33.32.156','port': 4444, 'bytes': 980000, 'hour': 3},
    {'src': '192.168.1.15', 'dst': '10.0.0.1',    'port': 22,   'bytes': 512,    'hour': 14},
]

SUSPICIOUS_PORTS = {4444, 1337, 31337}
OFF_HOURS = range(0, 6)

print('NetFlow anomaly scan:')
for flow in flow_records:
    flags = []
    if flow['port'] in SUSPICIOUS_PORTS:
        flags.append(f"suspicious port {flow['port']}")
    if flow['hour'] in OFF_HOURS and flow['bytes'] > 100000:
        flags.append(f"large off-hours transfer ({flow['bytes']} bytes)")
    if flags:
        print(f"  ALERT {flow['src']} -> {flow['dst']}: {', '.join(flags)}")
    else:
        print(f"  OK    {flow['src']} -> {flow['dst']}")

IP SLA — Proactive Latency Testing

IP SLA (Service Level Agreement) tells the router to run synthetic tests on a schedule — like an automated ping every 30 seconds — and log the results. Instead of users calling to say 'the internet is slow', the router tells you first. This is Performance management (the P in FCAPS) in practice: you define a baseline, set thresholds, and get alerted when measured values drift past them.

# Practice: Simulated IP SLA latency monitor

class ip_sla_monitor:
    def __init__(self, target, threshold_ms):
        self.target = target
        self.threshold_ms = threshold_ms
        self.readings = []

    def record(self, latency_ms):
        self.readings.append(latency_ms)
        if latency_ms > self.threshold_ms:
            return f'ALERT  {self.target}: latency {latency_ms}ms exceeds threshold {self.threshold_ms}ms'
        return f'OK     {self.target}: latency {latency_ms}ms'

    def average(self):
        return sum(self.readings) / len(self.readings) if self.readings else 0


sla = ip_sla_monitor('data-center-gateway', threshold_ms=50)

# Simulated readings arriving every 30 seconds
simulated_readings = [2, 3, 4, 2, 78, 92, 85, 3, 2]
for reading in simulated_readings:
    print(sla.record(reading))

print(f'\nAverage latency: {sla.average():.1f}ms')

📝 Exercise: Build a Multi-Target SLA Dashboard

Extend ip_sla_monitor so it tracks a violation_count alongside the readings list. Then create a dashboard() function that takes a list of monitors and prints a summary table: target, readings count, average latency, violations, and status (OK if 0 violations, DEGRADED if any).

code.py
Output

            

        

    


    

        ← Back to Chapter