Network Services, Monitoring and Protocol Analytics

Introduction

Modern networks are not merely collections of switches, routers and cables. They are service platforms that provide name resolution, address allocation, time coordination, identity management and operational visibility. A network may forward packets correctly and still fail users because DNS is unavailable, DHCP scopes are exhausted, clocks are inconsistent, authentication services are unreachable, or monitoring data is ignored.

This chapter examines the principal network services used in enterprise environments and the tools used to observe and analyse network behaviour. It connects configuration with operations: a service must be deployed correctly, measured against a baseline, protected from misuse and interpreted in context.

Learning Objectives

By the end of this chapter, you should be able to:

• Explain the roles of DNS, DHCP, NTP, directory services and AAA.
• Describe common deployment and security considerations for core services.
• Distinguish SNMP, syslog, flow records, telemetry, logs and packet captures.
• Establish useful operational baselines and interpret performance indicators.
• Identify anomalies using evidence from multiple monitoring sources.
• Apply a structured troubleshooting and incident-analysis process.
• Discuss governance, privacy and ethical issues in network monitoring.

1. Core Network Services

1.1 Domain Name System

The Domain Name System (DNS) translates human-readable names into resource records used by computers. The most familiar record is the address record: an A record maps a name to an IPv4 address, while an AAAA record maps a name to an IPv6 address. Other records include:

DNS is hierarchical. A recursive resolver accepts a client query and obtains an answer, either from its cache or by querying other servers. An authoritative server holds the definitive records for a zone. Root servers direct queries toward top-level domains, which direct them toward authoritative servers.

Caching improves performance and reduces external traffic. Each cached record has a time to live (TTL). A resolver should not use the record beyond its TTL unless it obtains a refreshed answer. DNS caching also means that configuration changes may not appear immediately to every client.

A typical enterprise design uses internal authoritative zones for private names, redundant recursive resolvers, and controlled forwarding to approved external resolvers. Split-horizon DNS provides different answers for internal and external clients when this is required, but it must be documented carefully because inconsistent views complicate troubleshooting.

DNS security concerns include cache poisoning, unauthorized zone transfers, domain hijacking, malicious records and denial-of-service attacks. Zone transfers should be restricted to approved secondary servers. DNSSEC can provide authenticity and integrity for signed DNS data, although it does not encrypt ordinary DNS queries. Encrypted transports such as DNS over TLS or DNS over HTTPS address confidentiality between a client and resolver, but introduce policy and monitoring considerations.

1.2 Dynamic Host Configuration Protocol

DHCP automatically supplies hosts with configuration such as an IP address, subnet mask, default gateway, DNS servers and lease duration. The basic IPv4 exchange is commonly described as DORA:

1. Discover: the client broadcasts a request.
2. Offer: a server proposes an address and options.
3. Request: the client requests one offer.
4. Acknowledgement: the server confirms the lease.

A DHCP scope defines the usable address pool and associated options. Addresses reserved for infrastructure, servers or printers should be excluded from dynamic allocation. Reservations bind a client identifier or hardware address to a predictable address, but reservations should not be treated as a substitute for appropriate access control.

Routers normally do not forward broadcasts between subnets. A DHCP relay agent forwards client requests to a central DHCP server and inserts information identifying the client subnet. Relay configuration is therefore essential in routed networks.

Important DHCP failure modes include exhausted scopes, incorrect relay addresses, overlapping scopes, rogue servers and incorrect gateway or DNS options. DHCP snooping on managed switches can identify trusted server ports and block server responses from untrusted ports. It can also create bindings used by other security features.

1.3 Network Time Protocol

NTP synchronizes system clocks across networks. Accurate time is necessary for log correlation, certificate validation, authentication protocols, scheduled jobs and incident investigation. An NTP client estimates the offset between its local clock and a reference source, then adjusts the clock gradually or, when the error is large, performs a controlled step.

A reliable design uses multiple upstream sources and a hierarchy of internal time servers. Domain controllers, routers and servers should normally use approved internal sources rather than independently contacting arbitrary public servers. NTP authentication can help prevent unauthorized time sources, although it does not solve every delay or path-manipulation problem.

Time quality must be interpreted carefully. Network delay is not always symmetrical, and a device can report synchronization while still having an unacceptable offset for a particular application. Monitoring should therefore measure offset, stratum, reachability and sudden clock changes.

1.4 Directory Services

A directory service stores and organizes identities and objects such as users, groups, computers, printers and policies. Lightweight Directory Access Protocol (LDAP) defines a common protocol for querying and modifying directory information. Enterprise directory platforms frequently provide authentication integration, centralized policy and group-based authorization.

A directory is usually organized hierarchically. An entry has a distinguished name and attributes. Groups simplify administration by allowing permissions to be assigned to roles rather than individual users. However, deeply nested groups and excessive privileges make authorization difficult to understand and audit.

Directory deployments require replication, backup, access control and secure transport. LDAP over TLS, often called LDAPS in operational usage, protects credentials and directory data in transit. Administrators should distinguish authentication—proving identity—from authorization—deciding what an identity may do.

1.5 AAA Services

AAA represents authentication, authorization and accounting. Authentication validates identity; authorization determines permitted actions; accounting records activity for auditing, capacity analysis or billing.

Common enterprise protocols include RADIUS and TACACS+. RADIUS is widely used for network access such as wireless authentication and 802.1X. TACACS+ is commonly selected for administrative access to network devices because it separates authentication and authorization and can provide detailed command accounting. Implementations vary, so the chosen protocol should match device support and security requirements.

AAA designs should include redundant servers, carefully defined failover behaviour and a controlled local emergency account. The emergency account must be protected and monitored; otherwise it becomes an untracked bypass. Multi-factor authentication provides stronger protection than passwords alone, especially for privileged access.

2. Monitoring and Observability

Monitoring collects evidence about infrastructure and services. Observability is the broader ability to infer internal system state from outputs such as metrics, logs and traces. In networking, no single source is sufficient in every situation.

2.1 SNMP

The Simple Network Management Protocol is traditionally used to read device variables and receive notifications. A management system polls agents using object identifiers (OIDs) defined in Management Information Bases (MIBs). Counters may report interface octets, errors, discards, CPU load and memory use. Traps or informs allow devices to send event notifications without waiting for a poll.

SNMPv1 and SNMPv2c use community strings and provide weak security. SNMPv3 supports authentication, integrity and optional encryption through its security models. SNMP should be restricted with access-control lists, management VLANs or dedicated management networks. Counter interpretation requires care: a rapidly increasing counter is not itself an error; its rate of change must be calculated.

For a counter C sampled at times t₁ and t₂, the average rate is:

Here C is a monotonically increasing counter and t is time in seconds. The formula assumes no counter reset or wrap between samples. For octet counters, the result is octets per second. If the counter wraps, the correction must use the counter’s defined modulus.

2.2 Syslog and Event Logs

Syslog transports event messages from devices and applications to collectors. A message commonly contains a timestamp, facility, severity and descriptive text. Severity indicates the sender’s assessment, not necessarily the operational impact. A low-severity message may be important when repeated many times, while a critical message may be harmless during planned maintenance.

Central collection protects evidence when a device fails and enables correlation across systems. Collectors should use accurate time, access controls, retention policies and, where supported, encrypted transport. Logs should be normalized so that fields such as source address, username, device, event type and result can be searched consistently.

2.3 Flow Records

Flow technologies summarize conversations rather than recording every packet. A flow commonly includes source and destination addresses, source and destination ports, protocol, interface, byte count, packet count and start and end times. NetFlow, IPFIX and similar technologies support questions such as:

• Which applications consume the most bandwidth?
• Is traffic moving between unexpected networks?
• Did a host begin contacting many destinations?
• Are denial-of-service patterns or data-exfiltration patterns present?

Flow records are efficient but incomplete. They generally do not contain payloads and may be sampled. Sampling reduces overhead but can miss short-lived or low-volume events. Flow data should therefore be combined with packet captures, endpoint logs and security alerts.

2.4 Streaming Telemetry

Traditional polling provides periodic snapshots. Streaming telemetry allows devices to publish measurements when values change or at high frequency. Model-driven systems commonly use structured schemas and protocols such as gNMI, NETCONF or RESTCONF, depending on the platform and operational model.

Telemetry can expose interface state, queue depth, routing information and hardware health with lower observation delay. Its advantages are accompanied by requirements for schema management, time-series storage, access control and capacity planning. High-frequency collection can itself generate substantial storage and processing demand.

2.5 Packet Captures

A packet capture records frames or packets observed at a selected point. It is the most detailed of the common evidence sources, but it represents only that observation point and capture period. A capture can reveal DNS failures, TCP retransmissions, handshake problems, incorrect MTUs, protocol errors and unexpected payload exchanges.

Capture filters restrict what is collected; display filters select what is examined after collection. A capture should record its location, interface, timestamp basis, filter and duration. Full payloads may contain credentials, personal data or confidential business information, so access and retention must be controlled.

3. Baselines and Performance Measurement

A baseline describes normal behaviour for a defined system, time period and workload. It should include ordinary variation, not merely a single average. Useful baseline dimensions include:

• Interface utilization, errors, discards and queue drops.
• DNS response latency, failure rate and response-code distribution.
• DHCP scope utilization and lease failures.
• NTP offset and synchronization status.
• AAA authentication success, rejection and timeout rates.
• CPU, memory, storage and temperature.
• Flow volume by application, host and direction.

For n observations x₁, x₂, …, xₙ, the arithmetic mean is:

The mean is useful when values are reasonably stable and extreme values are meaningful. The median is often better for skewed latency data. The population standard deviation is:

Here μ is the population mean, n is the number of observations and σ has the same unit as x. For a sample intended to estimate a larger population, the sample standard deviation uses n − 1 in the denominator and the sample mean in place of μ. A baseline must specify which interpretation is used.

Availability is often expressed as:

The measurement period and treatment of maintenance windows must be stated. A “99.9%” monthly target allows approximately 43.2 minutes of unavailability in a 30-day month, because 30 × 24 × 60 × 0.001 = 43.2 minutes. Availability alone does not describe latency, correctness or user experience.

Percentiles are particularly useful for networks. The 95th-percentile latency is a value at or below which approximately 95% of observations fall. It prevents a small number of extreme values from being hidden by an average, while still showing tail performance.

4. Protocol Analytics and Anomaly Investigation

Effective analysis follows a process rather than relying on isolated alarms.

1. Define the symptom: identify who is affected, what service fails and when.
2. Establish scope: compare users, sites, protocols and time periods.
3. Form hypotheses: consider DNS, DHCP, routing, congestion, authentication and endpoint causes.
4. Collect correlated evidence: align NTP-synchronized logs, metrics, flows and captures.
5. Test safely: perform controlled queries, path tests or configuration comparisons.
6. Determine cause and impact: distinguish the initiating fault from secondary symptoms.
7. Remediate and verify: make a controlled change and confirm recovery.
8. Document and improve: update the baseline, alert thresholds and procedures.

Common analytical relationships include utilization and error rate. If an interface sends B bytes during T seconds, its average throughput is B ÷ T bytes per second. For a link capacity R bits per second, approximate utilization is:

The factor 8 converts bytes to bits. This calculation assumes B represents traffic relevant to the capacity being assessed and that T is measured consistently. It does not by itself prove congestion: queueing, bursts, packet size, quality-of-service policy and physical errors must also be considered.

An anomaly is not automatically an incident. A scheduled backup can explain a traffic spike; a new application can explain a changed DNS pattern. Analysts should preserve context, avoid confirmation bias and compare observations against both technical baselines and planned-change records.

5. Applied Case: Intermittent Access to an Internal Application

The following is an illustrative case.

Background

A college reports that users intermittently cannot access its learning-management application. The application server is healthy, but complaints increase during morning classes.

Problem

The help desk initially reports “slow network performance.” The monitoring dashboard shows normal average link utilization, but DNS failure alerts and DHCP warnings are also present.

Analysis

The operations team compares data over 30-minute intervals. DNS response latency is normal when queries succeed, but the failure rate rises sharply. DHCP logs show that one wireless subnet is near exhaustion. Packet captures from an affected access segment show clients repeatedly broadcasting DHCP Discover messages. Flow records show no evidence of a data-centre congestion event.

Further investigation identifies an unauthorized DHCP server connected to a classroom switch. It offers addresses with an incorrect gateway and DNS resolver. Some clients accept the rogue offer; others receive the legitimate offer. This explains the intermittent nature of the incident.

Approach and Solution

The team disables the untrusted switch port, clears affected leases, and renews client configurations. DHCP snooping is enabled with only approved uplinks trusted. The legitimate scope is expanded after confirming address requirements, and monitoring is configured for scope utilization and unexpected DHCP responses.

Outcome

DNS failures return to baseline, application access stabilizes and the rogue server is removed. The incident review also identifies that the original monitoring system measured DNS availability only from the data centre, not from user subnets.

Learning Points

The case demonstrates that symptoms can cross service boundaries. A DNS alert may be caused by incorrect DHCP options rather than a DNS-server failure. Multiple evidence sources—logs, captures, flow data and configuration records—provide stronger conclusions than any one source. Monitoring locations must represent the user experience, and security controls should prevent known classes of infrastructure abuse.

6. Governance, Ethics and Professional Practice

Monitoring creates power as well as operational value. Packet payloads, usernames, DNS queries and authentication records may reveal personal behaviour or confidential information. Organizations should define a legitimate purpose, collect the minimum necessary data, restrict access by role and retain information only as long as justified.

Operational monitoring should comply with applicable privacy, employment, cybersecurity and records-management requirements. Staff should know what is monitored and why, subject to lawful security exceptions. Access to logs must be audited, and exported captures should be encrypted and securely destroyed when no longer required.

Alerting also has human consequences. Excessive false positives cause alert fatigue; poorly designed thresholds encourage analysts to ignore warnings. Thresholds should be tested, ownership should be assigned and service-level objectives should reflect business impact rather than arbitrary technical numbers.

Artificial intelligence and machine learning can classify logs, detect unusual flows and assist with event correlation. These tools are aids, not replacements for expert validation. Models can produce false positives, inherit biased training data, miss novel attacks and expose sensitive telemetry to unauthorized systems. A responsible deployment requires explainability appropriate to the decision, human review for high-impact actions and protection of training data.

7. Best-Practice Deployment Checklist

• Provide redundant DNS, DHCP, NTP, directory and AAA components where availability requires it.
• Use secure versions and encrypted management channels.
• Restrict administrative access and separate management traffic.
• Synchronize clocks before correlating events.
• Centralize logs and protect their integrity and retention.
• Monitor both service health and user-visible outcomes.
• Establish baselines by site, time and workload.
• Record configuration changes and maintenance windows.
• Combine metrics, logs, flow records and packet evidence.
• Test alerts and document response procedures.
• Protect captures and identity data as sensitive information.
• Review monitoring coverage after incidents and major changes.

Chapter Summary

Core network services provide the control functions on which reliable communication depends. DNS resolves names, DHCP distributes configuration, NTP coordinates time, directory services organize identities, and AAA controls access and records activity. Each service requires redundancy, security and operational monitoring.

SNMP supplies structured device measurements, syslog centralizes events, flow records summarize conversations, streaming telemetry provides frequent model-driven data, and packet captures reveal protocol-level detail. These sources complement rather than replace one another. Baselines, percentiles, utilization calculations and carefully defined availability measures turn raw observations into operational knowledge. Effective investigation correlates evidence, tests hypotheses and distinguishes normal variation from genuine anomalies. Governance, privacy, access control and human judgment remain essential, including when AI-assisted analytics are used.

Key Terms

DNS: Hierarchical system that maps names to resource records.

Recursive resolver: DNS server that obtains answers on behalf of clients.

Authoritative server: Server holding definitive records for a DNS zone.

DHCP: Protocol that automatically supplies host network configuration.

DHCP relay: Device that forwards DHCP messages between subnets.

NTP: Protocol for synchronizing computer clocks.

Directory service: Structured repository of identities and network objects.

LDAP: Protocol for accessing and modifying directory information.

AAA: Authentication, authorization and accounting.

SNMP: Protocol for monitoring and managing network devices.

MIB: Collection of managed objects and their definitions.

Syslog: Event-message system used for centralized logging.

Flow record: Summary of traffic between endpoints.

Streaming telemetry: Continuous or event-driven publication of structured measurements.

Packet capture: Recorded network frames or packets observed at a capture point.

Baseline: Documented pattern of normal system behaviour.

Percentile: Value below which a specified proportion of observations falls.

Anomaly: Observation that differs significantly from expected behaviour.

Alert fatigue: Reduced attention caused by excessive or low-quality alerts.

Review Questions

Short Answer Questions

1. What are the principal differences between a recursive DNS resolver and an authoritative DNS server?
2. Why is a DHCP relay required in many routed networks?
3. What are the three components of AAA?
4. How does a flow record differ from a packet capture?
5. Why is synchronized time important during incident investigation?

Long Answer Questions

1. Explain the operation, security risks and resilience requirements of enterprise DNS.
2. Compare SNMP, syslog, flow records and streaming telemetry in terms of data type, strengths and limitations.
3. Describe how an organization should establish and maintain a network performance baseline.
4. Explain why average utilization alone cannot prove that congestion caused an application problem.
5. Discuss privacy, access-control and retention considerations for logs and packet captures.

Analytical / Application Questions

1. A wireless subnet reports intermittent authentication failures. DHCP warnings, DNS failures and a new unmanaged switch are also observed. Develop a step-by-step investigation plan and identify the evidence you would collect.
2. An interface transmits 9,000,000,000 bytes in 60 seconds on a 2 Gb/s link. Calculate approximate utilization using the utilization formula and explain what additional evidence is needed before declaring congestion.
3. A monitoring system reports a sudden increase in DNS queries from one host, while flow records show connections to many unfamiliar external addresses. Explain at least three possible interpretations and propose a safe validation approach.

Multiple Choice Questions with Answers

Question 1

Which DNS component normally obtains answers from other DNS servers on behalf of a client?

A. Recursive resolver

B. DHCP relay

C. Authoritative switch

D. NTP stratum server

Correct Answer: A. Recursive resolver

Question 2

What is the correct order of the common IPv4 DHCP exchange?

A. Request, Discover, Offer, Acknowledgement

B. Discover, Offer, Request, Acknowledgement

C. Offer, Discover, Acknowledgement, Request

D. Discover, Request, Offer, Acknowledgement

Correct Answer: B. Discover, Offer, Request, Acknowledgement

Question 3

Which AAA function determines what an authenticated user is allowed to do?

A. Accounting

B. Addressing

C. Authorization

D. Aggregation

Correct Answer: C. Authorization

Question 4

Which technology is most directly associated with structured device polling using OIDs and MIBs?

A. SNMP

B. DNSSEC

C. LDAP

D. IPsec

Correct Answer: A. SNMP

Question 5

What is a major limitation of flow records compared with packet captures?

A. They cannot identify endpoint addresses

B. They generally do not contain packet payloads

C. They require synchronized clocks in every application

D. They can only represent wireless traffic

Correct Answer: B. They generally do not contain packet payloads

Question 6

A counter increases from 120,000 to 180,000 over 30 seconds. What is its average rate?

A. 2,000 units/s

B. 3,000 units/s

C. 4,000 units/s

D. 60,000 units/s

Correct Answer: C. 4,000 units/s

Question 7

Why should NTP synchronization be established before correlating logs from several devices?

A. It increases link capacity

B. It aligns event timestamps more reliably

C. It encrypts all syslog messages

D. It prevents DHCP broadcasts

Correct Answer: B. It aligns event timestamps more reliably

Question 8

Which control helps block unauthorized DHCP server responses on a managed switch?

A. DHCP snooping

B. DNS caching

C. NTP stratum selection

D. Flow sampling

Correct Answer: A. DHCP snooping

Question 9

A service has 30 days of agreed time and 43.2 minutes of unplanned downtime. What is its approximate availability?

A. 99.0%

B. 99.5%

C. 99.9%

D. 99.99%

Correct Answer: C. 99.9%

Question 10

Which statement best describes a packet capture?

A. A summary of conversations without packet details

B. A record of observed frames or packets at a selected point

C. A directory database of user identities

D. A list of DNS records only

Correct Answer: B. A record of observed frames or packets at a selected point