Russell Schwager May 6, 1998 russells@cs.cornell.edu Network Monitoring Russell Schwager May 6, 1998 russells@cs.cornell.edu

The Big Picture

Motivation Big sites have a large number of network nodes (Cornell has ~10,000). It’s impossible to have a network administrator keep an eye on all network nodes and detect problems. Changes in network stability can be unexpected and occur at any time of the day.

Approach Use simple and widely available tools and protocols to gather data and analyze it. Develop a notion for abnormal activity and use that notion to detect unusual activity when the data is analyzed. Log all unusual activity

Technical Details Use SNMP (simple network management protocol) to query network nodes. Have PERL scripts collect the data and analyze it. Create HTML pages, gnuplot graphs and text log files summarizing the data.

Example Data CSGate4 on March 8, 1998

Example Data (cont.)

Future Work Tie the work into the topology discovery and the simulation projects. Develop other heuristics and conditions that should be detected and logged.

Further Information Project Information: http://www.cs.cornell.edu/cnrg/netmon/ Cornell Network Research Group http://www.cs.cornell.edu/cnrg/