Network Management Protocols, Ping, SNMP and WMI

Understanding network management protocols is an important part of your job as a

network engineer and it's also important within the role of doing network management.

 Network management protocols for a key part of the solar wind’s product. In other
words, solar winds management tools make use of management protocols to
manage network devices.
 This video will provide an overview of how network management applications
leverage network management protocols.
 We also describe the different types of network management protocols that are
available and then explain the most common protocols.
when discussing network management protocols. We need to think about three main
things. Before we talk about that, we'll look at how Orion leverages network management
protocols and which types of protocols are leveraged for different types of monitoring.
 Solar Wind’s network performance monitor does both Fault monitoring as well as
performance monitoring.
 For fault management most network management systems including Solar Winds
use ICMP or ping to detect whether a device is up or down. It's as simple as the
network management system or NMS sending out a ping request and waiting for a
ping response. If the ICMP response isn't returned. The NMS assumes that the device
is down.
 Now in an Orion it works slightly differently, in that if a response isn't returned.
Orion places the nodes in a mode warning stage. which means that Orion is going to
do a fast poll of the device to verify that it's really down.
 NPM or Orion, by default will monitor the device in a fast polling mode for 120
seconds before notifies you that the device is down.
 This is configurable on the Advanced Settings in the NPM system manager.
 Monitoring for Faults on some elements like interfaces and volume's, is done
differently as it's done via by SNMP or simple network management protocol.
 For example, if the NMS is pinging a router to see if it's up or down and a
response doesn't come back.
 The NMS doesn't really know whether that device is down. All it knows is that the
response didn't come back. The device could be down, but they could also be a
routing problem, or an intermediate device could be down or a device between
the NMS and the router could be down. So, some device along the path could be
down or traffic could be blocked by an ACL or a firewall rule.
 all the NMS knows is that it can't reach the device that it's pinging.
 SNMP on the other hand is different, with SNMP the NMS is querying a device and
the device is telling the NMS via SNMP the state of an interface.
 So, if a device indicates that interface FastEthernet 0/0 as an example is down.
The NMS knows 100 percent that that information is accurate because it received
that information via SNMP from the device that it was querying.
  Now in the event that the actual is devices down rather than an interface on the
device. you will get an unknown state. That's a different type of signifier than if
the interface is down on a device that's up and running.
 In terms of performance monitoring, ICMP or ping is used for availability calculations
and latency response times.
 SNMP is used for almost all the other statistics including CPU, memory, buffers,
interface traffic and errors and many many other statistics.
 In some cases, for Windows systems, the NMSL might leverage WMI or Windows
management instrumentation to check for performance count a type of values.

Ping, SNMP, WMI

 For example, if the NMS is pinging a Router to see if it's up or down and a response
doesn't come back.
 The NMS doesn't really know whether that device is down.
 All it knows is that the response didn't come back. The device could be down, but
it could also be a routing problem, or an intermediate device could be done or a
device between the end a miss and the router could be down. So, some device
along the path could be down all traffic could be blocked by an ACL or a firewall
rule
 all the NMS knows is that it can't reach the device that it's pinging.
 SNMP on the other hand is different, with SNMP, the SNMP is querying a device and
the device is telling the NMS via an SNMP the state of an interface.
 So, if a device indicates that interface fast Ethernet 0/0 as an example is down.
The NMS knows 100 percent that that information is accurate, because it received
that information via SNMP from the device that it was querying.
 Now in the event that the actual device is down rather than an interface on the
device, you'll get an unknown state. That's a different type of signifier than if the
interface is down on a device that's up and running.
 In terms of performance monitoring ICMP or ping is used for availability calculations
and latency response timer. SNMP is used for almost all the other statistics including
CPU, memory, buffers, interface traffic and errors and many many other statistics.
In some cases, for Windows systems the NMSL might leverage WMI or Windows
management instrumentation to check for performance counter-top values.