FOUNDRYNETNo. 001SEPTEMBER 2026SECTION 04MONITORING
Network Monitoring Guide
Three guides on seeing what the network is doing: statistical traffic visibility with sFlow, counters and traps with SNMP, and full packet capture through a mirror port. The section inherits the sFlow technology page, the MIB reference and the monitoring chapter of the enterprise configuration guide.
04 Contents
- sFlow: Packet Sampling and Counter Polling for Switch MonitoringGuide
sFlow is a sampling-based monitoring standard built into switch hardware: one packet header in every N plus periodic interface counters, from which a collector reconstructs who talks to whom.
- SNMP MIBs: OIDs, MIB-II Objects and Enterprise TreesGuide
A MIB is the schema that tells a poller what a device can report and where each value lives in the OID tree. SNMP is the protocol that fetches it.
- Port Mirroring: How to Configure a SPAN Port and Capture TrafficHow-to
Port mirroring copies the frames passing through one switch port to another port where a capture host listens. It is the fastest way to see real traffic, and the easiest way to lose half of it.
- AI Crawler Traffic: Identifying LLM Bots at the Network EdgeGuide
AI crawlers announce themselves with a user-agent token, but the token is a claim; the network edge is where the claim gets checked against DNS, address ranges and behaviour.
- Bot vs Human Traffic: Fingerprinting Automated ClientsGuide
No single signal separates a script from a person, but a TLS handshake, an HTTP/2 preface, a TCP SYN and a click rhythm each leak something, and together they make a usable score.
- robots.txt and llms.txt: Telling AI Agents What to FetchGuide
Two small text files at the root of a site now carry most of the conversation between operators and AI clients. One is a 1994 convention standardised in 2022; the other is a 2024 proposal. Neither is a firewall.
- AI Agent Traffic: When a Browser Drives ItselfGuide
Crawlers fetch pages; agents use them. An agent opens a real browser, logs in, fills forms and clicks through a task on someone's behalf, which makes it look far more like a person than any crawler ever did.
- Verifying Bots With HTTP Message SignaturesHow-to
User-agent strings can be copied and IP lists go stale. A signature over the request, made with a key the operator publishes, is the first bot identity check that cannot simply be typed into a header.
- Answer Engine Referral Traffic: Measuring Visits From AI AnswersGuide
When an assistant cites a page and a reader clicks through, the visit is the only trace the site ever sees of the answer. Measuring those visits honestly means knowing what the Referer header carries and what it hides.
04.1 Orientation
There are three ways to know what a switch is doing, and they answer different questions. SNMP polls counters and receives traps: how many octets crossed an interface, is the power supply healthy, did a link flap. sFlow samples packets and exports headers: who is talking to whom, which protocols dominate, where a flood is coming from. Port mirroring copies every frame on a port to an analyser: what exactly was in the conversation. A monitoring design uses all three and knows which one to reach for when the phone rings.
sFlow covers the sampling model defined in RFC 3176, the arithmetic that turns a one-in-N sample into a traffic estimate with a known error, the agent-to-collector datagram, and a comparison with NetFlow and IPFIX. SNMP MIBs walks the OID tree from the standard interface table to a vendor enterprise branch, explains 32-bit counter wrap, and covers why version 3 is the only version that should touch a management network. Port mirroring is a procedure: choose direction, respect the oversubscription limit, configure the mirror and monitor ports, verify with a capture, and know when a TAP is the better tool.
Foundry was among the earliest switch vendors to implement sFlow in hardware, and its /technology/sflow/ page was cited widely as an explanation of the method. Its enterprise MIB lives under the private enterprise number 1991, which is the branch any poller needs when it inventories a legacy IronWare device. The IronView Network Manager, Foundry's management application, is profiled in the archive; the guides here explain the protocols it used and how the same job is done today with any collector and poller.
The monitoring chapter of the enterprise configuration and management guide, which covered port mirroring, was one of the most linked documentation pages on the old site because it answered a question every administrator eventually asks: how do I see this traffic? That question and its modern answer are the spine of the section. The recovered documents in the margin are that chapter, the MIB reference PDF and the sFlow technology page.
Monitoring also has security consequences that the original documents did not dwell on. A community string on an internet-facing interface, an sFlow collector on an untrusted segment or a mirror port left enabled after a capture are each a data leak. Every guide here says where the protocol should be allowed to travel and where it should be blocked. Two newer guides apply the same instruments to a current question, how much of a site's traffic is automated: identifying AI crawlers at the edge and telling scripted clients from people.
How this connects to the provenance section. Monitoring produces the raw material of evidence: samples, counters, mirrored packets and logs. Whether that material can be trusted later is the lane's question. Syslog delivered over TLS into append-only storage with hashes, so the log is an honest record is the first step, and packet captures preserved with a chain of custody record is what a mirror port should feed when a capture might be disputed. Both depend on an NTP hierarchy every device shares.