12. Ensuring Network Availability

UDP/123

3 of 38 Which port is used by the Network Time Protocol (NTP)?

Raising the level to 6 will capture less severe events (up to informational level) so more events will be forwarded.

A technician has recommended changing the syslog logging level from its current value of 3 to 6. Will this cause more or fewer events to be forwarded?

Traffic shapers

Appliances and/or software that enable administrators to closely monitor network traffic and to manage that network traffic. The primary function of a traffic shaper is to optimize network media throughput to get the most from the available bandwidth.

Network Time Protocol (NTP)

Application protocol allowing machines to synchronize to the same time clock that runs over UDP port 123.

Syslog

Application protocol and event logging format enabling different appliances and software applications to transmit logs or event records to a central server. Syslog works over UDP port 514 by default.

Remote Desktop Protocol (RDP)

Application protocol for operating remote connections to a host using a graphical interface. The protocol sends screen data from the remote host to the client and transfer mouse and keyboard input from the client to the remote host. It uses TCP port 3389.

Secure Shell (SSH)

Application protocol supporting secure tunneling and remote terminal emulation and file copy. SSH runs over TCP port 22

Telnet

Application protocol supporting unsecure terminal emulation for remote host management. Telnet runs over TCP port 23.

Simple Network Management Protocol (SNMP)

Application protocol used for monitoring and managing network devices. SNMP works over UDP ports 161 and 162 by default

NetFlow

Cisco-developed means of reporting network flow information to a structured database. NetFlow allows better understanding of IP traffic flows as used by different network applications and hosts.

sensor

Device that can report environmental conditions such as temperature or chassis intrusion to a monitoring system.

performance baseline

Estimated performance or stability of a service based on historical information or vendor guidance.

Bandwidth

Generally used to refer to the amount of data that can be transferred through a connection over a given period. Bandwidth more properly means the range of frequencies supported by transmission media, measured in Hertz.

Differentiated Services (DiffServ)

Header field used to indicate a priority value for a layer 3 (IP) packet to facilitate Quality of Service (QoS) or Class of Service (CoS) scheduling.

bandwidth speed tester

Hosted utility used to measure actual speed obtained by an Internet link to a representative server or to measure the response times of websites from different locations on the Internet.

A traffic shaper can reserve bandwidth so that QoS parameters, such as maximum latency and jitter, for a real-time data application can be guaranteed.

How does a traffic shaper benefit real-time data applications?

Via a trap.

How does an SNMP agent report an event to the management system?

By buffering packets.

How is jitter mitigated by a VoIP application?

The field is 3-bit, allowing up to 8 values. In a typical schema, 7 and 6 can be reserved for network control (such as routing table updates), 5 and 4 map to expedited forwarding levels for 2-way communications, 3 and 2 map to assured forwarding for streaming multimedia, and 1 and 0 for "ordinary" best-effort delivery.

How many different traffic classes can be defined by 802.1Q/p?

802.1p

IEEE standard defining a 3-bit (0 to 7) class of service priority field within the 802.1Q format format.

performance metrics

Measurement of a value affecting system performance, such as CPU or memory utilization.

interface statistics

Metrics recorded by a host or switch that enable monitoring of link state, resets, speed, duplex setting, utilization, and error rates.

terminal emulator

Software that reproduces text input and output for a given command shell or OS.

Quality of Service (QoS)

Systems that differentiate data passing over the network that can reserve bandwidth for particular applications. A system that cannot guarantee a level of available bandwidth is often described as Class of Service (CoS).

Latency

The time it takes for a signal to reach the recipient. A video application can support a latency of about 80 ms, while typical latency on the Internet can reach 1000 ms at peak times. Latency is a particular problem for 2-way applications, such as VoIP (telephone) and online conferencing.

logging level

Threshold for storing or forwarding an event message based on its severity index or value.

interface errors

Troubleshooting issue where an interface reports packet errors due to frame corruption and other factors.

bottleneck

Troubleshooting issue where performance for a whole network or system is constrained by the performance of a single link, device, or subsystem.

False. While the server must be configured with a key pair, the client can optionally use a key pair to authenticate, or can use another mechanism, such as a password.

True or false? SSH must be configured with two key pairs to operate; one on the server and one on the client.

iperf

Utility used to measure the bandwidth achievable over a network link.

Jitter

Variation in the time it takes for a signal to reach the recipient. Jitter manifests itself as an inconsistent rate of packet delivery. If packet loss or delay is excessive, then noticeable audio or video problems (artifacts) are experienced by users.

Simple Network Time Protocol-A simpler protocol derived from NTP that enables workstations to obtain the correct time from time servers.

What is SNTP?

An interface that receives the most incoming traffic.

What is a top listener in terms of network monitoring?

Telnet

What remote management service is associated with TCP port 23?

Audit/security/access log

What sort of log would you inspect if you wanted to track web server access attempts?

The software could produce an alert if network performance did not meet any given metric.

What would be the purpose of configuring thresholds in network monitoring software?

Processing (CPU and memory) resource. In some circumstances, you might also want to monitor local storage capacity.

You have a plan for monitoring switches and routers that accommodates network metrics (bandwidth, latency, and jitter) plus chassis temperature and intrusion. What other performance metric should be monitored?

Monitoring errors and discards/drops would help to prove the cause of the problem.

You suspect that a network application is generating faulty packets. What interface metric(s) might help you to diagnose the problem?