Monitoring methods include ICMP ping, SNMP, TCP/UDP ports, system APIs, proprietary agents and applications. ICMP ping, SNMP and TCP/UDP ports are the most commonly gathered kinds of data. Each point monitored by a server adds to the load and limits the number of devices/nodes the server can monitor, but most low-priced network-management products now include distributed pollers, which poll devices and report back to the central or master server; thus you can poll many more devices than the physical limit of a single server. Also, this setup not only lightens the central server's load, it slashes the amount of network bandwidth needed for polling because the distributed poller-to-central-server communication is usually compressed and sometimes is bandwidth sensitive. This sensitivity is valuable when the poller and central server are separated by a WAN link.

Glossary Host MIB RFC1514: Defines an open and standard MIB for managing host systems. Unfortunately, the Host MIB was seldom loaded. Now, when SNMP is loaded on a Microsoft Windows 2000 server, the Host MIB is loaded by default. See www.faqs.org/rfcs/rfc1514.html..

Performance monitoring, another important and well-developed feature of more expensive network-management products, can be found in sub-$10K packages, though the implementations are not as extensive. Most rely on SNMP MIB II data, with the better products leveraging the fact that, by default, Microsoft Windows 2000 loads the Host MIB, which provides performance data for CPU, memory and volume.

Proprietary MIBs and agents are not as well supported in midrange products, except that some of these apps occasionally use an agent on the network-management server to proxy SNMP traffic. The side benefit is that, even at this low price point, we were able to gather quite a bit of system-performance data on our network-management server.

Fault management, or the collection of event streams, was so-so in low-priced products. They'll be able to collect SNMP traps and events, and as long as the number of interfaces remains below 1,000, the volume of events will be manageable. Of course, if those interfaces are close to central backbone devices, the number of events--and their importance--will be greater.

Finally, missing from the most inexpensive products--except for those designed to grow--is event correlation. In some cases the app will filter and apply Boolean logic to the event stream so it can manage the number of events displayed to the operator. Correlations for downstream and duplicate event suppression are advanced functions usually available only on those network-management products that are more expensive, feature-rich and able to support much larger networks.

Bruce boardman is executive editor of Network Computing, testing and writing about network management and systems. He has 12 years' IT experience managing network and distributed computing for a financial services provider. Write to him at bboardman@nwc.com.