Simple Network Management Protocol — collects and organizes device metrics for monitoring and management.
Simple Network Management Protocol uses a manager-agent model: a central NMS queries agents in routers, switches, and servers over UDP port 161, while agents send unsolicited trap alerts to the manager on UDP port 162. The MIB (Management Information Base) defines the object identifiers (OIDs) that map to each metric a device exposes. The key exam distinction is version: SNMPv1 and v2c send community strings in cleartext, making them trivially sniffable, while SNMPv3 adds authentication and optional encryption for secure networks. Note that SNMP polls for metrics, while syslog pushes event logs.
A standard protocol for sending and centralizing log messages from network devices to a server.
Syslog is a standardized protocol that lets network devices — routers, switches, firewalls, and servers — forward event and status messages to a centralized syslog server for storage and analysis. It runs over UDP port 514 by default, though many implementations also support TCP port 514 or TLS-secured TCP port 6514 for reliable, encrypted delivery. Centralizing logs makes correlating events across many devices practical and supports security auditing. A key exam distinction is that syslog is a passive, one-way logging mechanism, not an active monitoring protocol like SNMP, which polls devices and sends bidirectional traps. Severity levels run from 0 (Emergency) to 7 (Debug), and a lower number always indicates higher severity — a common point of confusion.
Continuously observing network performance, availability, and traffic to detect problems early.
Network monitoring is the continuous collection and analysis of performance metrics, availability data, and traffic patterns across a network infrastructure. Tools gather data using protocols such as SNMP (UDP port 161) for device polling and syslog (UDP port 514) for centralized log aggregation, then trigger alerts when thresholds are breached. The exam frequently tests the distinction between proactive and reactive monitoring. Establishing a documented baseline first is what makes anomaly detection meaningful — without one, high CPU or bandwidth spikes have no reference point. Watch for questions that conflate ongoing monitoring with a one-time network assessment or audit, which are scoped, point-in-time activities.
A recorded measure of normal network performance used to detect deviations later.
A performance baseline is a documented snapshot of normal network behavior captured over a representative period, recording metrics such as bandwidth utilization, latency, error rates, device CPU load, and packet loss. It is the reference point against which future measurements are judged; without it, alert thresholds and anomaly detection have no empirical foundation. On the N10-009 exam, distinguish a baseline from a threshold: a threshold is a single trigger value, while a baseline is the full picture of normal over time. Re-establish baselines periodically as networks change.
Techniques that prioritize critical traffic, such as voice and video, over less time-sensitive data.
Quality of Service (QoS) is a set of traffic-management mechanisms that protect bandwidth and reduce latency and jitter for time-sensitive applications such as VoIP, video conferencing, and streaming. It classifies packets and marks them with priority values—DSCP in the IP header or 802.1p priority bits inside the 802.1Q Layer 2 tag—then applies queuing and scheduling so high-priority traffic forwards first. For the exam, note that traffic shaping (one QoS tool) delays excess traffic to smooth bursts, while QoS overall assigns relative priority between traffic classes; know which mechanism targets latency versus bandwidth exhaustion.