Network Operations: Monitoring, Documentation, and Continuity
Monitoring and telemetry
SNMP polls agents on UDP 161 and receives traps on 162; MIBs define the object tree and OIDs identify individual values. Syslog on UDP 514 centralizes event messages with severity levels from 0 (emergency) to 7 (debug). Flow tools such as NetFlow, sFlow, and IPFIX summarize who talked to whom, while packet capture records the actual bytes. Establish baselines so anomalies are measurable.
Documentation and change control
Maintain physical and logical diagrams, an IP addressing schema, rack elevations, and cable labeling. Every change should have a record, a rollback plan, and an approval path. Configuration management means versioned golden configurations and controlled patching.
Continuity and recovery
Recovery objectives drive design. RTO is how long a service may be down; RPO is how much data may be lost, measured backward from the failure. Backups may be full, incremental, or differential, and restore chains differ. Cold, warm, and hot sites trade cost against recovery speed. Test plans with tabletop exercises, and track SLA metrics such as MTTR and MTBF.
Traps
Questions frequently swap RTO and RPO. Remember that a differential backup needs only the last full plus the latest differential, while incremental restores require every increment in sequence. NetFlow is metadata, not full packet capture. SNMP traps are pushed; polling is pulled. Syslog severity numbers run opposite to intuition: lower numbers are more severe.
Rule of thumb
Ask "how fast must we be back?" for RTO and "how much data can we lose?" for RPO. If the scenario describes acceptable data loss in minutes, that number is the RPO, no matter how the question phrases downtime.