Syslog, SNMP, NTP, network monitoring tools and penetration testing

Syslog

Syslog is the standard way for network devices to send event messages, such as interface changes, logins and errors, to a central server (usually UDP 514), so they are stored safely and can be searched. Each message has a facility (its source), a severity level, a timestamp and the message text.

Setting a logging level sends that level and everything more severe. Memory aid: Every Awesome Cisco Engineer Will Need Ice cream Daily.

SNMP

The Simple Network Management Protocol lets a manager (NMS) read and change information held by an agent on each device, organised in a MIB, and receive alerts (traps and informs).

NTP: accurate time

If every device's clock is different, logs can't be correlated and investigations fall apart. Certificates and some authentication also depend on correct time. The Network Time Protocol (UDP 123) synchronises clocks from a reliable source. Accuracy is described by stratum: stratum 0 is a reference clock (GPS or atomic), stratum 1 servers connect directly to it, and so on. Use NTP authentication so devices only accept time from trusted servers.

Network monitoring

A network monitoring system constantly watches for slow or failing components and alerts administrators by email, SMS or dashboard. Benefits: catch problems before outages, fix issues faster, save staff time, manage growing networks and spot security threats. When choosing a tool, consider:

• scope and the devices it supports;
• connectivity and scalability;
• deployment: on-premises, cloud or hybrid;
• automatic discovery and topology mapping;
• flexible alerting.

Widely used options include Zabbix and Nagios (open source), PRTG, SolarWinds NPM and ManageEngine OpManager.

Penetration testing

Penetration testing (ethical hacking) means testing systems, networks or applications, with written permission, to find weaknesses an attacker could exploit. It can be automated or manual. Benefits: manage risk properly, improve business continuity, protect customers and partners, show whether security spending works, and protect the organisation's reputation.

Real-world example: logs that did not line up

A secondary school investigated a night-time outage on its main internet link. The firewall, core switch and wireless controller had all logged events, but their clocks disagreed by up to eleven minutes, so the IT technician could not tell which event came first. The school configured every device to use the same NTP servers and to send syslog messages to one central server, with timestamps on each message.

It also set SNMP monitoring with traps for interface-down events, so the monitoring system sends an email and a text message when an uplink fails. A few weeks later, the uplink dropped again at 02:14. This time the correctly ordered logs showed the ISP router rebooting first, and the school sent the evidence to its provider, who replaced a faulty power supply.