1. Russell Schwager May 6, 1998 russells@cs.cornell.edu
Network Monitoring
Russell Schwager
May 6, 1998

2. The Big Picture

3. Motivation
Big sites have a large number of network nodes (Cornell has ~10,000).
It’s impossible to have a network administrator keep an eye on all network nodes and detect problems.
Changes in network stability can be unexpected and occur at any time of the day.

4. Approach
Use simple and widely available tools and protocols to gather data and analyze it.
Develop a notion for abnormal activity and use that notion to detect unusual activity when the data is analyzed.
Log all unusual activity

5. Technical Details
Use SNMP (simple network management protocol) to query network nodes.
Have PERL scripts collect the data and analyze it.
Create HTML pages, gnuplot graphs and text log files summarizing the data.

6. Example Data
CSGate4 on March 8, 1998

7. Example Data (cont.)

8. Future Work
Tie the work into the topology discovery and the simulation projects.
Develop other heuristics and conditions that should be detected and logged.

9. Further Information
Project Information:
Cornell Network Research Group