What is Network Monitoring?

What is network monitoring?

Network monitoring is the discipline of continuously observing the health, performance, and traffic flow of the network infrastructure that connects servers, services, and users. It tracks devices (routers, switches, firewalls, load balancers, access points), links (bandwidth utilization, packet loss, latency, jitter), and the protocols running on top (BGP, OSPF, DNS, TLS) so that an operator can detect a degraded link, a saturated uplink, or a flapping interface before users notice slow page loads or failed API calls.

The output is usually a real-time topology view, per-interface metrics graphs, threshold alerts on counters like bandwidth or error rate, and a flow database (NetFlow, sFlow, IPFIX) that answers "what traffic was crossing this link at 14:32." Tools in the space include SolarWinds, PRTG, LibreNMS, Zabbix, Nagios, Cisco ThousandEyes, Kentik, and Catchpoint.

Network monitoring vs infrastructure monitoring vs APM

These three layers overlap in tooling but answer different questions:

• Network monitoring watches the pipes: link utilization, packet loss, routing changes, DNS resolution time. Best for diagnosing "the network is slow" complaints.
• Infrastructure monitoring watches the hosts: CPU, memory, disk, container counts, kernel metrics. Best for diagnosing "this server is overloaded."
• APM watches the application: per-endpoint latency, slow database queries, error rate per code path. Best for diagnosing "checkout is slow for this customer."

A complete operations stack runs all three. See infrastructure monitoring and application performance monitoring for the adjacent layers.

What network monitoring covers

• Availability: ICMP ping, SNMP up/down, port reachability checks at fixed intervals.
• Bandwidth and throughput: bytes per second per interface, peak vs average, percentile usage over time.
• Loss, latency, jitter: active probes (synthetic) or passive flow analysis; the three classic real-time-traffic killers.
• Routing and protocol health: BGP session state, OSPF neighbor changes, MPLS LSP up/down events.
• Flow data: NetFlow/sFlow/IPFIX records per conversation, used for capacity planning and security forensics.
• Configuration drift: snapshot of device configs, diff over time, alert when a change is unauthorized.

Key network monitoring metrics

1. Uptime and availability percent: per device and per link, rolled up to a service SLA.
2. Bandwidth utilization: percent of link capacity in use, p95 across the measurement window.
3. Packet loss percent: dropped packets divided by sent, watched per interface and per probe path.
4. Latency (RTT) and jitter: round-trip time and its variance, key for VoIP, video, and trading.
5. Error and discard counters: CRC errors, FCS errors, output drops; sustained nonzero values mean cabling, optics, or buffering trouble.
6. DNS resolution time: often the silent contributor to slow page loads when an authoritative resolver degrades.

How to run network monitoring

Pick a poller (SNMP for traditional gear, gNMI or streaming telemetry for modern Cisco/Juniper/Arista), point it at every device, and store the time series in Prometheus, InfluxDB, or the vendor backend. Add active probes (smokeping, blackbox_exporter) for synthetic latency between sites. Add a flow collector (nfdump, Akvorado, Kentik) for per-conversation visibility. Then build dashboards organized by site, by service, and by SLA, with alerts on the metrics that map to user impact (loss, latency, link saturation) rather than every counter that exists.

Network monitoring complements load testing. When a load test shows degraded latency, network monitoring tells you whether the bottleneck is in the network (saturated uplink, packet loss) or above it (slow application, slow database). Pair both signals during a launch readiness review. See also latency for the percentile framework that underpins both disciplines.

If your team needs production-shape traffic generated against your monitored network to validate capacity, LoadFocus offers load testing services from cloud regions matched to your real user geography, with the runs scheduled to coincide with your network monitoring baseline windows.