IP SLA & Object Tracking — Failover on Health

Routing protocols see up/down and adjacencies — never latency, jitter, loss or a dead application. IP SLA injects synthetic probes (ICMP echo, UDP jitter, TCP connect, HTTP GET, DNS) every 60 s and measures what real traffic would feel. ip sla 1 icmp-echo 10.0.0.1 source-interface Gi0/0 threshold 100 frequency 10 ip sla schedule 1 life […]

Network Telemetry — Push-Based Monitoring

SNMP asks repeatedly and learns late. Telemetry inverts it: the device pushes state streams on schedule (or on event) over gRPC/TCP, encoded in GPB or JSON, shaped by YANG data models — Model-Driven Telemetry. Subscription = what data, how often, where to. Near real-time, low per-poll overhead, scales where polling collapses. Three modes: dial-out periodic, […]

NetFlow & Flexible NetFlow

Interface counters say how much; NetFlow says who talks to whom, how, when. Flows are keyed on the classic 7-tuple minus two (src/dst IP, src/dst port, protocol, ToS, interface), counted in a cache and exported to a collector when the flow ends or times out. v5 fixed format; v9 template-based; Flexible NetFlow = build your […]

SPAN, RSPAN & ERSPAN

Switches don’t let you sniff other people’s traffic — SPAN copies frames from source ports/VLANs (rx, tx or both) to a dedicated monitor port feeding Wireshark or an IDS. Original traffic untouched; the monitor port stops switching. RSPAN: mirrors across switches through a dedicated remote-span VLAN — L2 domain only. ERSPAN: GRE-encapsulated, routable across L3 […]

Syslog — Facilities, Severity & Timestamps

Every event is classified facility (which subsystem) + severity 0–7 (emergency → debug; “0 is worst, 7 is chattiest”), shipped to a central server over UDP/514 — or TCP/6514 with TLS when logs matter for compliance. service timestamps log datetime msec localtime show-timezone logging host 192.168.1.50 transport tcp logging trap informational logging source-interface Loopback0 logging […]

SNMP — Polls, Traps & v3 Security Model

Manager ↔ agent over UDP: queries on 161, traps/informs on 162. Devices expose a MIB tree addressed by OIDs; managers poll (GET/GETNEXT/GETBULK) or receive async TRAP (fire-and-forget) / INFORM (acknowledged). Version Security Notes v1 cleartext community legacy v2c still cleartext adds GETBULK, everywhere v3 auth (SHA) + priv (AES) the only correct choice; needs NTP […]