CloudLabBox
Try the free demo

Network+ lab 16 of 27

Network monitoring: SNMP and flow data with port mirroring

Set up the three classic ways to watch a network. You poll a router with SNMPv2c and secure SNMPv3, receive traps, export NetFlow records of who talks to whom, and mirror a switch port to a capture host, where you see why SNMPv2c's community string is no secret.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 3,328 MB in total. That fits the free demo too.

In your workspace: Shared, then CompTIA Network Plus N10-009 guided labs, then 16 - Network monitoring - SNMP and flow data with port mirroring

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
5 vCPU, 3,328 MB
Smallest plan
Lite

The scenario

Harbour Logistics' network has no monitoring: problems are found when users phone. You'll set up the three classic views:

  • SNMP, so the monitoring server (NMS) can poll devices and receive alerts.
  • Flow data, so you can see who talks to whom and how much.
  • Port mirroring, so a capture host can see a busy port's traffic without being in its path.
DevicePortAddressRole
R1SW1 Gi0/010.10.10.1/24, Lo0 203.0.113.1router: SNMP agent, NetFlow exporter
NMSSW1 Gi0/110.10.10.100/24Ubuntu desktop with net-snmp tools (open its console for RDP; root / eve, then a MATE Terminal)
H1SW1 Gi0/210.10.10.50/24user PC that makes traffic
SNIFFERSW1 Gi0/3nonecapture host on the mirror port

Settings (teaching values): SNMPv2c read-only community H4rbour-RO, allowed from the NMS only; trap community H4rbour-TRAP; SNMPv3 user nmsadmin, SHA Auth-Pass-123, AES-128 Priv-Pass-123; location "Harbour Logistics Felixstowe".

What you’ll practise

  • Explain SNMP managers, agents, MIBs, OIDs, polling and traps
  • Configure SNMPv2c with a restricted community and SNMPv3 with authentication and privacy
  • Poll a device with snmpget and snmpwalk and read numeric OIDs
  • Enable NetFlow, read the flow cache and export flows to a collector
  • Configure port mirroring (SPAN) and capture mirrored traffic
  • Use interface counters as baseline metrics

The tasks

  1. Prepare the hosts
  2. Mirror the router's port
  3. Poll the router with SNMPv2c
  4. Secure SNMP with version 3
  5. Send traps
  6. Collect flow data
  7. Take a baseline

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Network monitoring - SNMP and flow data with port mirroring5 nodes, 4 links. Every link is listed as text below the diagram.R1SW1NMSH1SNIFFERGi0/0Gi0/0Gi0/2eth0Gi0/1eth0Gi0/3eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to SW1 Gi0/0
  • SW1 Gi0/1 to NMS eth0
  • SW1 Gi0/2 to H1 eth0
  • SW1 Gi0/3 to SNIFFER eth0
Nodes in Network monitoring: SNMP and flow data with port mirroring, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
SW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
NMSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
SNIFFERAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CompTIA Network Plus N10-009 guided labs.

  3. Open 16 - Network monitoring - SNMP and flow data with port mirroring and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network+ labs

All Network+ labs

Related labs in other courses

CloudLabBox is independent of CompTIA, Cisco and Netgate. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.