Content

| 7.2 |  | Gathering Information on Application Layer Problems |
| 7.2.9 |  | Network management systems |

Network management systems are always software-based tools. They continually monitor the network. There are various types of network management systems and not all are equal. Some are better at status monitoring and fault management tracking while others are better at service-level reporting. The choice is sometimes confusing since features overlap.

Network Management System (NMS) functions can be categorized into three main categories:

- Operations management
- Device management
- Service management

Operations management tools are used for active monitoring of day-to-day network administration. The software provides features such as network topology discovery, status monitoring, fault management, and basic real-time performance data. Major vendors include HP OpenView (current market leader), Computer Associates, and IBM Tivoli.

Device management tools are typically vendor specific. They are used to manage a vendor's network components to make configuration changes to network devices and to apply rules and policies. Most provide graphical tools to interact with actual devices. Examples of device management tools include Cisco Systems’ CiscoWorks (Cisco), Navis iEngineer (Lucent), and Optivity (Nortel).

Service management tools focus on QoS and service-level guarantee issues. They collect performance data over time that is then used for establishing a baseline, trend analysis, historical usage analysis, and service-level reporting. The tools focus on comparing the expected quality of network resources with actual results. Major vendors include HP, Lucent, and NetScout Systems.

SNMP
Network management tools use the Simple Network Management Protocol (SNMP) to capture and communicate device data. NMS periodically polls the devices it manages, sending queries for their current status. The monitored devices respond by transmitting the requested data and by sending traps (called notifications in SNMPv2).

A trap is an unsolicited message to the NMS, generated when a monitored parameter reaches unacceptable levels. For example, an environmental monitoring device may send a trap when the temperature level is too low or too high. Traps are useful because they provide a method for a device to signal that something unexpected has occurred.

In SNMP, the term manager refers both to the monitoring software running on the NMS and the actual device running the software. Similarly, the term agent refers to the device being monitored and to the software used by the monitored devices to generate and transmit their status data.

SNMP is a client-server protocol that normally communicates on TCP and UDP ports 161. SNMP traps use TCP and UDP ports 162. Some vendors use nonstandard ports for traps (for example, Cisco uses TCP and UDP ports 1993).