Domain 3 — Network Operations

Lesson 3 · Domain 3 — Network Operations · Download .docx

Objectives

Explain SNMP components (agent, manager, MIB, OID, trap) and syslog severity levels.
Describe NetFlow, SIEM, QoS, DSCP, and out-of-band management.
Apply high availability concepts including MTBF, MTTR, HSRP/VRRP, RTO, RPO, and standby site types.
Explain load balancing algorithms and the difference between Layer 4 and Layer 7 balancing.

Key terms

SNMP: Simple Network Management Protocol — port 161 (UDP); polls devices for OID metrics.
MIB: Management Information Base — database defining SNMP OIDs for each device metric.
SNMP Trap: Unsolicited alert sent by an SNMP agent to the manager when an event threshold is crossed.
syslog: Standard for centralized device logging; 8 severity levels (0=Emergency to 7=Debug).
NetFlow: Cisco flow-export protocol collecting src/dst IP, protocol, and byte counts for traffic analysis.
SIEM: Security Information and Event Management — aggregates and correlates logs from all network sources.
QoS: Quality of Service — classifies and prioritizes real-time traffic (VoIP, video) over bulk data.
DSCP: Differentiated Services Code Point — 6-bit IP header field marking packets for QoS priority treatment.
OOB: Out-of-Band management — console port or dedicated management network for device access when production is down.
MTBF: Mean Time Between Failures — average time between failures; higher = more reliable.
MTTR: Mean Time to Repair — average time to restore after failure; lower = faster recovery.
FHRP: First Hop Redundancy Protocol — HSRP, VRRP, or GLBP providing a virtual default gateway.
RTO: Recovery Time Objective — maximum acceptable downtime after a failure.
RPO: Recovery Point Objective — maximum acceptable data loss (how old can a backup be).

The concept

NETWORK MONITORING: SNMP, SYSLOG, AND NETFLOW

Effective network operations depend on three monitoring layers. SNMP (port 161 UDP) collects device metrics: an agent running on the device reads OID values from the MIB and responds to manager polls (GetRequest). When a threshold is crossed, the agent sends an unsolicited SNMP Trap (port 162) to the manager — this is asynchronous and does not require polling. Syslog centralizes text-based log messages from devices to a syslog server. Severity levels range from 0 (Emergency — system unusable) through 3 (Error), 4 (Warning), 6 (Informational), to 7 (Debug). A SIEM aggregates syslog, SNMP, firewall, and endpoint logs, then applies correlation rules to detect threats that no single source reveals alone. NetFlow exports IP flow records (five-tuple: source IP, destination IP, source port, destination port, protocol, plus byte count) — essential for bandwidth analysis, capacity planning, and identifying unauthorized data transfers.

QoS AND TRAFFIC MANAGEMENT

QoS prevents real-time traffic from being starved during congestion. VoIP requires latency below 150ms and jitter below 30ms — bulk file transfers do not. QoS marks packets using DSCP (a 6-bit field in the IP header's ToS byte). Network devices read the DSCP value at each hop to prioritize the packet. Common classes: EF (Expedited Forwarding) for VoIP, AF (Assured Forwarding) for video, BE (Best Effort) for bulk data. Out-of-band (OOB) management via console port or a dedicated management network ensures device access even when the production network is down.

HIGH AVAILABILITY METRICS AND PROTOCOLS

Availability is quantified with two metrics: MTBF (Mean Time Between Failures) measures reliability — the average operating time between failures; MTTR (Mean Time to Repair) measures recovery speed — the average time from failure to restoration. Availability % = MTBF / (MTBF + MTTR). First Hop Redundancy Protocols (FHRP) protect the default gateway: HSRP (Cisco-proprietary) and VRRP (open standard RFC 5798) each assign a virtual IP and MAC shared between an active and standby router. If the active fails, the standby takes over in seconds — clients are unaware. Load balancers distribute sessions across multiple servers using round-robin, least-connections, or weighted algorithms. Layer 4 load balancers use IP and port; Layer 7 can use URL paths, cookies, or HTTP headers.

DISASTER RECOVERY SITES AND OBJECTIVES

Recovery objectives define the DR plan's constraints. RTO is the maximum acceptable downtime — systems must be restored within this window. RPO is the maximum acceptable data loss — backups must run frequently enough that no more than RPO time of data is lost. DR site types: cold sites have space and power but no equipment (days to activate); warm sites have pre-staged hardware needing configuration (hours); hot sites mirror production in real time (minutes to fail over). Redundant power supplies, RAID storage, and clustering at the component level complement site-level DR.

Standards alignment: CompTIA Network+ Objectives 3.1 (Operations), 3.2 (Availability); Maryland Blueprint College and Career Readiness — Technology and Engineering.

Worked examples

Example 1: A network manager notices that the core switch is showing 95% CPU in SNMP polling. She checks the syslog server and sees 'STP topology change' events flooding in — timestamps every 2 seconds. A new unmanaged switch plugged in by a user has created a bridging loop. She identifies the port by checking which access port is sending SNMP interface errors, and disables it. The CPU drops to 12%. Root cause: STP loop triggered by a rogue unmanaged switch. Monitoring tools used: SNMP (CPU), syslog (events), interface statistics.

Example 2: A hospital's SLA requires systems to be back online within 30 minutes of any failure (RTO=30 min) and allows no more than 15 minutes of lost transactions (RPO=15 min). The team evaluates site options. A cold site (days to activate) fails the RTO immediately. A warm site (4–8 hours) also fails. A hot site with synchronous replication (near-zero RPO, minutes to fail over) meets both objectives. The team selects the hot site option and documents the recovery procedure.

Common mistakes

Confusing MTBF and MTTR — MTBF is between failures (reliability), MTTR is repair time (recovery speed). Both affect availability.
Thinking HSRP and VRRP are interchangeable everywhere — HSRP is Cisco-only; VRRP is the open standard used in multi-vendor environments.
Confusing RTO (downtime limit) with RPO (data loss limit) — RTO answers 'how long can we be down?'; RPO answers 'how much data can we lose?'
Assuming syslog level 0 (Emergency) is routine — it indicates the system is completely unusable; anything that triggers level 0 requires immediate response.
Using DSCP marking at the edge only — QoS marking must be trusted and honored at every hop in the path; remarking at untrusted boundaries is a common oversight.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. What does a syslog severity level of 0 (Emergency) indicate?

2. NetFlow records contain which of the following?

3. VRRP differs from HSRP in that VRRP:

4. RPO defines:

5. Layer 7 load balancing can distribute traffic based on:

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top