1. ICmyNet.IS - Networking Information and Monitoring System

2. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Akademska mreža Srbije www.amres.ac.yu Content Concepts Features Monitoring elements Tools Use cases Further development

3. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Architecture and User Interface Java platform Linux web application server MySQL/PostgreSQL database backend Client access Web Interface - typical user access Standalone client application

4. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Web Interface Independent to OS Web browser – IE, Mozilla Typical usage View and Edit modes

5. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Standalone client application Independent to OS Efficient GUI advanced system configuration Java web-start technology – RMI Automatic download up-to-date software from server, local execution Clients communicate with web server only, no direct access to DB Simplifies technical maintenance and support

6. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Note Keeps arbitrary text data Saving certain information connected to the parent element Example: for Devices - history of comments about hardware changes, distributor of the device, period of guarantee, reaction procedure in the case of network problem etc. for Locations – description of the presented organization for Users – CVs for Ports - troubleshooting procedures in case of failure

7. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 User People in charge (helpdesk, administrator, operator, contact, email) Relevant information (name, address, telephone) NetIIS user usernames and passwords Permissions for access to the system – read and write Predefined users: guest – access public data with read permission, no password required administrator – full read/write access to data and all tools

8. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 User User Group User and User group

9. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Networking information system Presents all objects from the external world in the most efficient and easily understood way Hierarchically organised and presented by a tree Basic elemets: Folder Location Device Port

10. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Monitoring System Passive and active monitoring the network status – status of devices, ports, links, services Performs: Performance measurement Failure notification Configured on Devices or Ports and in that context are executed

11. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Monitor Permanently and periodically observes the status of the computer network Defined within devices or ports as their children Typical presentation - putting monitors in groups Monitor types: Traffic monitor Port monitor SNMP monitor ping monitor service monior (nagios plug-ins) external monitor

12. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 RRD Chart MRTG like chart Arbitrary time frame Defined under the Monitors Purpose: Measures the values of the monitor during a period of time Shows the chart for a chosen period of time

13. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Alarm Defined under the Monitors Compares values of the monitor within given thresholds Alarm activation in the case of criteria fulfilment Can execute the given notification action Two general types Bad Alarm (connection failure) Good Alarm (link recovery) Critical levels in the range from -10 to +10.

14. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Action Action is adjoined to certain Alarms Define in which way the NetIIS system is going to react in the case of alarm activation. There are 2 types of action: E-Mail Action - sends e-mail messages to a certain user or user groups SMS Action - sending SMS messages to a certain user or user groups. Defining messages of arbitrary content that are sent with other parameters connected to adhered alarms and monitor Default Action is notification in the Event log

15. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Traffic Monitor Predefined SNMP monitor under Port object Measures data traffic through the network interface Variables: var(1) and var(2) - Bytes per sec var(3) and var(4) - bits per sec RRD Chart for var(3) and var(4) Input traffic - green colour Output traffic - blue colour Alarms can be set up to react to certain traffic intensity.

16. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Ping Monitor Defined under Device object Executes native ICMP ping service towards this device Measures the results of ping command 6 variables for packet delay and percentage of lost packets Includes two RRD Chart objects Ping Delay - measures the minimum and maximum delay of ping packets (var(1) and var(2)) Ping Loss - measures the percentage of lost packets (var(6)) Alarms for the Ping Loss percentage

17. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Port Monitor Predefined SNMP monitor under Port object Observes administrative and operational status of the network interfaces var(1) – administrative status (1.3.6.1.2.1.2.2.7) var(2) – operational status (1.3.6.1.2.1.2.2.8) Children: RRD Chart related to administrative and operational statuses Alarms related to the operational status Good Alarm – "var(2) == 1". Message: "Link is UP" Bad Alarm –"var(2) != 1". Message is: "Link is DOWN“ Mail action is configured on Alarms with the same message.

18. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Port Monitor Router ARouter X DOWN Trap support

19. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Packet Loss = 0 % Router B Router A Router X DOWNUP Ping and Port Monitors usage

20. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Pre-defined SNMP Monitors Pre-defined and often used SNMP Monitors are: Packets Monitor BGP Monitor CPU Load Monitor System Memory Monitor

21. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Packet Monitor Measures packets flow on the interface in a similar way to Traffic Monitor Useful in the case of detecting anomalies in the network traffic In the case of DoS attack or an attempt of virus expansion on the network, the network traffic (in bps) does not have to rise, but it will increase the number of packets Two variables: Var(1) - Interface In Packets (unicast) OID=.1.3.6.1.2.1.2.2.1.17 Var(2) - Interface Out Packets (unicast) OID=.1.3.6.1.2.1.2.2.1.18 Unit: Packets per second RRD can be attached to the Monitor

22. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 BGP Monitor Measures the status of BGP sessions Monitor in variable var(1) returns the current status of the session with certain peer. OID suffix is required - IP address of the BGP peer.1.3.6.1.2.1.15.3.1.16.147.91.0.112 RRD Chart assigned StateDescription 1IdleSession has not been configured 2ConnectAttempt to connect, session still not established 3ActiveAttempt to establish session, session still not established 4OpenSentRequest for connection sent, session still not established 5OpenConfirmAnswer for request received, session still not established 6EstablishedSession successfully established

23. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 CPU Usage Monitor Three variables, the processor utilization in time intervals of 5s, 1min and 5min Correspondent OID’s are not standardised, they are specified exclusively for Cisco devices and belong to the MIB hierarchy of the Cisco Systems RRD Chart refers to the variable var(2), for processor utilization in the time interval of 1min

24. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 System Memory Monitor Measures more variables, specified exclusively for Cisco devices Requests input of suffixes to the defined OIDs Processor memory - suffix.1 interface memory - suffix.2,.3 or even higher value RRD Chart refers to variables var(4) and var(8), for the memory usage in percentage. varDescription var(1)Memory Name - memory name that is being monitored var(2)Used Memory (suffix) – used memory in bytes var(3)Free Memory (suffix) – free memory in bytes var(4)Used Memory – free memory in percentage 100 * var(2) / (var(2) + var(3)) var(5)Memory Name – memory name that is being monitored var(6)Used Memory (suffix) – used memory in bytes var(7)Free Memory (suffix) – free memory in bytes var(8)Used Memory – free memory in percentage 100 * var(6) / (var(6) + var(7))

25. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Service monitor – nagios plug-in

26. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Service monitor – nagios plug-in

27. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Report Selected SNMP variables shown predefined table Executed on the user’s request (on-demand) Recognizes existing monitors and charts

28. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Group Serves for grouping other objects for joint presentation in certain form Objects are grouped by creating shortcuts Objects can be assigned to a number of groups. One group can contain other groups Group types: Simple Group (default) - showing elements in a table format Graph - graphical presentation of the topology Looking Glass - joins devices that enable remote command execution - Looking Glass functionality

29. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Group

30. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Data hierarchy Setup process

31. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Link hierarchy Network topology

32. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Link hierarchy Network topology

33. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 AutoDiscovery AutoDiscovery function aims: Easing the initial database population Updating - topology, new devices and relevant data AutoDiscovery types: Device Attributes Discovery – system data Ports Discovery - interfaces data CDP Neighbours Discovery – likn topology Layer 3 Hosts Discovery – ARP table Discovery on hop-by-hop basis Better overview and control over the process No retrieval of the entire network Possibility of clear database organisation in the system

34. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Lokacija A Lokacija 1 Ruter 1 Lokacija A3 Ruter B Serial 0 Serial 1 Ruter A Ruter C Ruter D Serial 1 Router A Serial 0 Ruter A2 Ruter A1 Ruter A3 ModelModel WarrantyWarranty Contract numberContract number… PC1 PC2 PC3 PC4 PC5 M M AutoDiscovery

35. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Other Concepts Repository inactive predifined objects Recycle Bin deleted objects Tools Event Log Alerts Chart viewer SLA reports Search panel

36. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Event Log

37. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Alerts Current alerts (active alarms)

38. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Chart viewer

39. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 SLA report Service Availability Statistics

40. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009 Use case corporate network example

41. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

42. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

43. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

44. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

45. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

46. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

47. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

48. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

49. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

50. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

51. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

52. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

53. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

54. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

55. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

56. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

57. GN3/NA3/T4 - Network monitoring workshop Belgrade, 20-21 October, 2009

58. Questions...