TechKnowSurge
NIST NICE K0848 NIST NICE K1175 CompTIA Security+ 4.4 NIST NICE K0849 NIST 800-53 SI-4
TechKnowSurge Catalog Videos Polling
VideoSecurityFree

Polling

Network monitoring goes beyond simple up/down scanning by using polling, protocols like SNMP and WMI, and optional agents to collect granular performance data — CPU usage, RAM, storage, temperature, and more — from devices across the infrastructure. A centralized monitoring platform aggregates this data to give administrators a full, real-time picture of network health.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network monitoring goes beyond simple availability scanning to provide granular visibility into how devices and services are actually performing. Polling — the practice of actively querying devices for current status information — allows administrators to track metrics like CPU utilization, RAM consumption, available storage, and environmental conditions such as data center temperature. These data points, collected from servers, switches, routers, and specialized hardware like UPS units, give teams the context needed to assess whether systems are functioning at the required level and to pinpoint the source of a problem when performance degrades. Centralized monitoring platforms aggregate all of this information in one place, eliminating the need to log into individual devices during an incident. Communication between monitored devices and the central monitoring server relies on a set of established protocols. SNMP (Simple Network Management Protocol) is widely used across network hardware and allows administrators to configure traps that send alert data when thresholds are crossed. WMI (Windows Management Instrumentation) serves a similar role for Windows environments, while SSH is commonly used for Linux-based systems. Many applications also expose APIs that monitoring platforms can query directly. In cases where agentless methods do not provide sufficient depth — for example, when monitoring a SQL database — installing a lightweight agent on the target system can surface much more granular application-level data, giving administrators a fuller picture of what is happening inside that specific workload.

What you'll learn

What's covered

Network Monitoring & Polling

Aligned to

NIST NICE
K0848 Knowledge of network systems management principles and practices
K1175 Knowledge of network monitoring tools and techniques
K0848 Knowledge of network systems management principles and practices
K0849 Knowledge of network systems management tools and techniques
K0849 Knowledge of network systems management tools and techniques
CompTIA Security+
4.4 Explain security alerting and monitoring concepts and tools.
NIST 800-53
SI-4 System Monitoring

Key terms

Simple Network Management Protocol
SNMP
A protocol used to monitor and manage network devices such as routers, switches, and servers.
Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
Secure Shell
SSH
A cryptographic network protocol that provides secure remote login and command execution over an unsecured network.
Polling
A monitoring method that actively queries devices or systems to retrieve resource metrics such as CPU usage, RAM, or temperature.
SNMP Trap
An unsolicited alert message sent by a network device to a monitoring system when a specific event or threshold condition occurs.
Agentless Monitoring
A network monitoring approach that collects device data using existing protocols such as SNMP, WMI, or SSH without installing software on the monitored device.
Agent-Based Monitoring
A network monitoring approach that installs dedicated software agents on devices to collect and report more granular performance data to a central monitoring system.
Windows Management Instrumentation
WMI
Windows Management Instrumentation is a Windows subsystem providing a management infrastructure for querying and modifying system configuration; attackers abuse WMI for lateral movement, persistence, and command execution because it is a trusted Windows component.

Topics

Network Monitoring Snmp Polling Wmi Agentless Monitoring Performance Metrics Networking

Transcript

Beyond Up or Down

When we do scanning on our network, we're determining if a piece of equipment exists, if it's up and running, if a certain service is up and running on it. But maybe we want more than just a yes or no, is it on, is it available. Maybe what we want to know is more detailed, like what is the CPU running at, what is the percent that the CPU is running at, what is the RAM, how much RAM is filled up, how much storage do we have left — maybe some more granular details. So in this case maybe we do polling.

Polling just means checking the status of something. Many times we want to check the status of a piece of equipment beyond just whether it's available or not. We want to actually see what is the percent that it's running at, or the saturation that it's running at.

A good example is that a lot of our network closets have air conditioning in them. There's an air conditioning unit over here — you can't see it right here, but there's an air conditioning unit over here. One of the things we would want to monitor is going to be temperature. So I would actually have temperature gauges in the room that I could address electronically, and they would actually be polled into our PRTG system for monitoring purposes, and they were incorporated into our UPSs.

There are a lot of different sensors that we could monitor on all of our different equipment. Things are specific to certain types of databases or certain types of applications, so we can make sure that they're up and running and that they're functioning at the level that we need to have them running at. So it really gives us a full perspective of what's happening on our network, and if there is an issue, how we can troubleshoot that issue and figure out where the issue is stemming from.

Monitoring Software

A lot of this polling really happens already on the different pieces of a system. A server will already be keeping track of all sorts of things, and same thing with desktop machines, and same thing with switches, same thing with routers. But the problem now is, if there is an issue, how do we go to each one of these devices and check each one of these devices? Well, that's where monitoring software comes into place.

What we could do is set up monitoring software on one of our devices and then make a connection out to all of these other devices. Sometimes it goes and grabs the information and pulls it back, and other times it's just a push and it gets sent to these devices. So there are different methodologies on how to grab this different information, but essentially we will have a server on here that's keeping track of that, which allows us to get on there and see what's happening on our network.

Protocols That Facilitate This

There are also several different types of protocols that help facilitate this. Because the communication is happening from these devices to some sort of central service here, we need protocols, ways of communicating back and forth.

  • Simple Network Management Protocol, SNMP, is one of those protocols, and when we set this up we call them traps — we're going to trap certain information and send it along its way.
  • Windows Management Instrumentation, or WMI, is another mechanism that allows for this.
  • For Linux machines we can use things like SSH.
  • A lot of applications have things like APIs that we can plug into to grab this type of information.

Agentless Monitoring and Agents

Let's say there's a machine that we want to monitor. There are a lot of ways that we can monitor it: through some of the protocols that I mentioned before, like WMI, and we could do the scanning, like the ping and those types of things, to see if these services are up and running. So there are a lot of different ways we can make sure of the health of the system without ever installing anything on that system.

However, there are sometimes when we install agents, which gives us a greater level of understanding of what's happening on that machine. A good example of this would be like SQL database software that I've used in the past, where we've installed an agent on there and it gives us much more granular information.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →