Chapter 20 Network Monitoring
An SNMP agent listens on which port when used with TLS?
10161
SNMP agents use UDP port:
161 10161 (TLS)
SNMP managers use UDP port:
162 10162 (TLS)
Simple Network Management Protocol (SNMP)
A TCP/IP protocol used to monitor network traffic. It creates a managed network
Security Information and Event Management (SIEM)
A two-part process consisting of security event monitoring (SEM), which performs real-time monitoring of security events, and security information management (SIM), where the monitoring log files are reviewed and analyzed by automated and human interpreters.
In an SNMP managed network, which software does a managed device run?
Agent
Set
An NMS can tell an agent to make changes to the information it queries and sends (variables)
Trap
An agent can solicit information from an NMS
Where does a packet sniffer put information it collects?
Capture file
An SNMP system uses ________________ PDUs for querying agents.
Get
SNMP systems 4 core functions called PDU's:
Get Response Set Trap
How does an SNMP managed system categorize data that can be queried?
MIB
In an SNMP managed network, which software does an SNMP manager run?
NMS
What component in NetFlow stores information from NetFlow caches?
NetFlow Collectors
A primary tool for capturing and analyzing the flow of packets from one device to another is called ________________.
Netflow
Managed network
Network that is monitored by the SNMP. Consists of 3 components: SNMP manager Managed devices Management information bases
John is conversing with another tech who consistently uses the term "network analyzer" when discussing network monitoring tools. What sort of tool is he using?
Packet analyzer
Jason is concerned about the communication between two workstations and wants to capture and analyze that traffic to see if anything illicit is going on. Which tool would best serve his needs?
Packet sniffer
Metrics
Performance and use option numbers used by interface monitors. Examples include bandwidth, utilization, packet drops, error rates, etc
SNMP manager
Requests and processes information from the managed devices. Runs a specialized software called a network management station (NMS)
A newly hired networking wiz works through the weekend and proudly announces at the Monday staff meeting, "Now you techs can't hide from your duties. All problems with managed devices will be reported to your cell phones." What did the wiz add to the SNMP managed system?
SMS alerts
A(n) ________________ requests and processes information from managed devices.
SNMP manager
An analysis of a network shows a lot of traffic on one machine on port 162. What kind of machine is it?
SNMPmanager
The boss at a small business wants to implement a management system for his network, but due to the sensitive nature of the traffic flowing, that data needs to be secure. Which version of SNMP should he implement?
SNMPv3
Response
Sent by an agent with requested information
Get request
Sent when an SNMP manager wants to query an agent
Which PDU enables a tech to change the variables queried of a managed device?
Set
Agents
Specialized software ran by managed devices
Network Management Station (NMS)
Specialized software used by SNMP manager
flow cache
Stores sets of flows for interpretation and analysis. A single flow entry usually contains info such as destination/source address, destination/source port, etc.
NetFlow
The primary tool used to monitor packet flow on a network. Developed by Cisco
Log management
The process of providing proper security and maintenance for log files to ensure the files are organized and safe.
Interface monitor
Track bandwidth and utilization of one or more devices on a network
An agent uses ________________ PDUs to solicit information from an NMS.
Trap
Management Information Base (MIB)
Used by SNMP to categorize data that can be queried
flow
a flow of packets from one specific place to another
baseline
a log of performance indicators that give a picture of the network when working properly
protocol analyzer
a program that processes captured files from packet sniffers and analyzes them,
packet sniffer
a program that queries a network interface and captures packets in a file (capture file)
Raphael can compare the results of a current Performance Monitor output with the ________________ to see if the network is performing correctly.
baseline
Bart has a choice of tools to view his managed network, but he primarily wants to see graphs of various types of data, such as the overall traffic and the current capacities of the file servers. Which tool offers him the best option?
cacti
Graphing programs like ________________ can show everything about specific switches, such as bandwidth usage.
cacti
A packet sniffer queries a network interface and collects packets in a(n) ________________.
capture file
Jill suspects a switch on Level 12 has a bottlenecked port, with too much traffic. Which tool would enable her to check that port specifically?
interface monitor
Use a(n) ________________ program to track the quantity and utilization of traffic through a physical port or ports on a single device.
interface monitor
Performance monitors use a(n) ________________ to store some form of performance information about a system.
log
Cindy's newly installed Windows network runs great! She needs to create a baseline now for later analysis. Which tool should she use?
performance monitor
The ________________ utility tells the SNMP manager to perform a series of Get commands.
snmpwalk
Logs
store information about the performance of some particular aspect of a system
Performance monitor
tracks performance of some aspect of a system over time and notifies when things aren't normal
snmpwalk
uses a sequence of GETNEXT requests to query network entities for a tree of information