Monitoring: SNMP versions, traps, MIBs, flow data, packet capture, baselines, log aggregation and syslog, API integration

Monitoring tells you how the network is behaving before users call. It combines several data sources, each with a different level of detail and cost: device statistics via SNMP, conversation summaries via flow data, full packets via capture, and events via logs. Knowing which source answers which question is a core Network+ skill. A useful mental model is increasing depth: SNMP tells you a link is busy, flow data tells you who is making it busy, and a packet capture tells you exactly what they are sending.