English
Menu

SNMP vs Syslog vs NetFlow: What Each Tells You in Monitoring

Running a network means monitoring the state of devices and traffic, noticing problems early and investigating their causes. SNMP, syslog and NetFlow all collect information from devices, but they tell you different things. With SNMP, a managing system (the manager) queries devices (agents) for values such as interface traffic and CPU usage, which tells you "how much". With syslog, devices send events such as links going down, logins and configuration changes as text messages to a logging server, which tells you "what happened when". NetFlow (and IPFIX, the standard based on it) summarizes traffic per group of packets that share the same source, destination and so on (a flow) and exports the summaries, which tells you "who talked to whom, and how much". In practice, all three are used together.

AspectSNMPsyslogNetFlow (IPFIX)
What it tells youDevice state and quantities: interface traffic and error counts, CPU and memory usage, link statusEvents: links going down, successful and failed logins, configuration changes, errorsA breakdown of traffic: which source and destination pairs, using which protocol and ports, sent how much
How data is collectedThe manager queries at a fixed interval (polling); devices can also report problems with notifications (traps)The device sends a message to the server when an event happensThe device aggregates flows and exports them to a collecting server (collector) when a flow ends or at fixed intervals
Data formatValues defined in MIBs (counters and states), addressed by object identifiers (OIDs)Severity (0 to 7), source type (facility), timestamp and a text messagePer-flow records: addresses, port numbers, protocol, packet and byte counts, start and end times and more; the fields are defined by templates
Time granularityAn average over each polling interval (for example 5 minutes)Per event, arriving almost immediatelyPer flow; long-lived flows are cut into pieces and exported at fixed intervals
What it cannot tell youWhose traffic it isTraffic volumePacket contents (data); nor device values such as CPU usage
Load on devices and linksSmallSmall, though messages can surge during a failureLarger; on fast links, sampling that examines only some of the packets is sometimes used
Standards and port numbersSNMPv3 is RFC 3411 to 3418; UDP port 161 (queries) and 162 (traps)RFC 5424; UDP port 514, or 6514 when using TLSNetFlow v9 is described in RFC 3954 (an informational RFC); the standardized IPFIX is RFC 7011, port 4739
SecurityIn v1 and v2c, the community string travels unencrypted; v3 adds authentication and encryptionOver UDP there is neither encryption nor delivery confirmation; TLS can protect itNetFlow v9 has no built-in protection; IPFIX can be protected with TLS or DTLS
Main usesTraffic graphs, tracking link utilization, detecting device failuresInvestigating the causes of failures, recording who did what, security monitoring (collected into a SIEM)Finding hosts and applications that use a lot of bandwidth, detecting unusual traffic, planning link upgrades

Figures are typical orders of magnitude and vary by process generation and product.

When to use which

SNMP
When you want to watch link and device utilization continuously as graphs. To notice device failures and link outages right away, combine it with traps.
syslog
When failures and security-related events should be recorded with timestamps so they can be investigated later. To correlate logs from several devices, keep device clocks synchronized with NTP.
NetFlow (IPFIX)
When a link is congested and you want to find which hosts or applications are using the bandwidth, or when you want to spot unusual traffic patterns.

FAQ

How do you get a traffic rate from SNMP counters?

Read an interface's received or transmitted byte counter at a fixed interval, convert the difference from the previous reading to bits and divide by the interval in seconds. For example, if the counter grew by 3,750,000,000 in 5 minutes (300 seconds), 3.75×10⁹ × 8 ÷ 300 = 1×10⁸ bit/s, an average of 100 Mbps. A 32-bit counter wraps to 0 after about 4.3 billion and quickly goes around on fast links, so 64-bit counters are used. The result is an average over the interval, so short bursts are not visible.

When should SNMP polling and traps be used?

Polling, in which the manager reads values at a fixed interval, suits continuous records of change such as traffic graphs. Traps, sent by the device when something like a link failure occurs, let you notice right away, but because they are sent over UDP they can be lost. There are also acknowledged notifications (informs). In most cases both are combined.

What is syslog message severity?

RFC 5424 expresses the severity of a message in eight levels, from 0 (Emergency: system is unusable) to 7 (Debug: debug-level messages). Lower numbers are more important, and each device can be configured to send only messages at or above a chosen severity to the server.

How does NetFlow differ from packet capture?

Packet capture records the packets themselves, including their contents, so it allows detailed analysis but produces a very large amount of data. NetFlow does not record packet contents and exports only summaries such as packet and byte counts per flow, so it greatly reduces the amount of data and suits looking at long-term trends. Even for encrypted traffic, the addresses, port numbers and volume are visible.

Check your understanding

Using SNMP, a router interface's 64-bit counter of received bytes is read every 5 minutes (300 seconds). The previous reading was 1,200,000,000 and the current one is 4,950,000,000. Which is closest to the average receive rate over these 5 minutes?

  1. A12.5 Mbps
  2. B100 Mbps
  3. C500 Mbps
Show answer and explanation

Answer: B. 100 Mbps

The interface received 4,950,000,000 − 1,200,000,000 = 3,750,000,000 bytes in 5 minutes, or 3.75×10⁹ × 8 = 3×10¹⁰ bits. Dividing by 300 seconds gives 1×10⁸ bit/s, or 100 Mbps. In SNMP, the managing side (the manager) queries MIB values from the agent on the device and, as here, works out traffic from differences between counter readings to draw graphs. A 32-bit counter wraps back to 0 after 2^32 ≈ 4.29×10⁹ bytes, which at 100 Mbps takes only about 344 seconds, so 64-bit counters are used for fast interfaces.

For the traffic passing through a router, you want to find out how many bytes are taken up by each combination of source and destination (addresses, port numbers and protocol), aggregated per stream of traffic. Which mechanism is the most appropriate to use?

  1. ASNMP
  2. Bsyslog
  3. CNetFlow (IPFIX)
Show answer and explanation

Answer: C. NetFlow (IPFIX)

NetFlow, and IPFIX, the standard based on it, record the packet count, byte count, times and so on for each group of packets with the same source and destination addresses, port numbers and protocol (each flow), and send the records to a collector server. They are used to find which hosts or applications are using bandwidth and to spot unusual traffic. SNMP is a protocol for querying values such as per-interface traffic and CPU usage on equipment and for having equipment report problems (traps); it cannot tell whose traffic it is. syslog sends events such as links going down or logins as text messages to a logging server.

Which correctly describes UDP?

  1. AIt does not establish a connection or control retransmission and ordering, so its header is small and there is no wait before sending
  2. BIt establishes a connection, retransmits data that did not arrive and puts data back in order at the receiver
  3. CIt delivers data to the destination host using only MAC addresses, without IP addresses
Show answer and explanation

Answer: A. It does not establish a connection or control retransmission and ordering, so its header is small and there is no wait before sending

UDP is a lightweight protocol that adds only port numbers and a simple error check (checksum) on top of IP; its header is 8 bytes (TCP's is 20 bytes without options). With no connection setup, no delivery confirmation and no retransmission, it is used for voice calls and live video, where a little loss is better than delay, and for DNS, which needs just one query and one response. If reliability is needed, the application provides it; QUIC, used by HTTP/3, implements retransmission and encryption on top of UDP. Connection setup, retransmission and ordering are what TCP does.

Practice Network Design and Operations questions

Key terms explained

SNMP (Simple Network Management Protocol)
A protocol for monitoring and managing the state of equipment such as routers and switches. The managing side (the manager) queries the agent on the equipment for values defined in the MIB, such as interface traffic counters and CPU usage, and the equipment reports problems with traps. Traffic is worked out by reading counter values at regular intervals and taking the difference. SNMPv3, which supports authentication and encryption, is recommended.
UDP (User Datagram Protocol)
A connectionless transport-layer protocol. Its header is 8 bytes and holds only port numbers, a length and a checksum. It has no connection setup, no acknowledgments or retransmission and no ordering, so it adds little delay. It is used for DNS queries, voice and video calls, online games, DHCP and QUIC, among others.
Port number
A number from 0 to 65535 used by TCP and UDP to identify which application on a host the traffic is for. Ports 0–1023, such as 80 for HTTP, 443 for HTTPS and 53 for DNS, are called well-known ports.
Packet
A unit of data for transmission: data split into pieces no larger than a set size, each with a header carrying control information such as the destination. Packets let many conversations share one line (packet switching) and let only the damaged part be resent after an error. Depending on the layer, the units are often called packets in IP, segments in TCP and frames in Ethernet. PCI Express and networks-on-chip also send data as packets.
Router
A network-layer (layer 3) device that forwards packets between different networks. It compares the destination IP address of each packet with its routing table, picks the next router (next hop) and the outgoing interface, and sends the packet on. Home routers also bundle NAPT, a DHCP server and a firewall.
SIEM (security information and event management)
A system that collects logs from firewalls, servers, EDR, cloud services, authentication infrastructure and more in one place, normalizes their formats and timestamps, detects suspected attacks with rules that combine several events (correlation analysis) and presents them as alerts. It is also used to search logs during investigations and to retain logs for long periods as regulations require. It is one of the central tools that analysts in a security operations center (SOC) use for monitoring.
TLS
Transport Layer Security. A protocol that encrypts communication, detects tampering and authenticates servers with certificates. HTTPS is HTTP protected by TLS.

Related comparisons