Traffic Analyzer (MRTG, PRTG, SNMP, Packet Tracer, Wireshark)

Computer Network & Network Security System — Application Layer, NEC licence examination syllabus (Nepal Engineering Council).

Traffic Analyzer Tools: watching the network's pulse

You can't fix what you can't see — these tools make network traffic visible.

📡 SNMP — Simple Network Management Protocol

ManagerThe central system that monitors the network.

AgentSoftware running on each managed device (router, switch, server), reporting its status.

MIBManagement Information Base — a structured database describing exactly what data each agent can report.

🛠️ The Common Tools

MRTG / PRTGMonitor and graph network traffic/bandwidth usage over time, typically using SNMP under the hood.

Packet TracerA network SIMULATION tool (by Cisco) — build and test virtual network topologies without needing real hardware.

WiresharkCaptures and inspects REAL packets flowing on an actual network — down to individual header fields — the tool professionals reach for when actually debugging a live network problem.

💡 Know the key distinction: Packet Tracer simulates a network that doesn't really exist; Wireshark captures traffic from a network that actually does. Don't mix these up in a comparison question.

Polling and traps — why SNMP has both

SNMP works in two directions, and the reason is the same trade-off as polling versus interrupts in the device-driver topic.

📡 Two ways the manager learns things

PollingThe manager asks each agent at intervals. Predictable load, and it detects a device that has died silently — but a fault occurring just after a poll goes unnoticed until the next one.

TrapThe agent reports an event immediately without being asked. Fast, and generates no traffic when nothing is wrong — but a trap from a device that has just failed may never be sent at all.

Neither alone is sufficient, which is why real monitoring uses both: traps for prompt notification of events the device can report, and polling to catch the failures a dead device cannot tell you about. A monitoring system relying only on traps is blind to exactly the worst case — total failure, where there is nobody left to send the trap.

Which tool answers which question

🔍 Different tools, different layers

MRTG / PRTG"How much traffic, over time?" — long-term graphs of volume and utilisation. Good for capacity planning and spotting trends; says nothing about individual packets.

Wireshark"What exactly is in this conversation?" — every field of every packet. Definitive for diagnosis, and drowns you instantly if pointed at a busy link without a filter.

Packet Tracer"What would happen if…?" — a simulator, so nothing observed in it is real traffic. For learning and design, not diagnosis.

💡 The distinction examiners test: MRTG tells you that the link is saturated; Wireshark tells you what is saturating it. Aggregate monitoring finds the problem and packet capture identifies the cause — which is why a diagnosis usually starts with the first and ends with the second.

💡 Wireshark can only capture traffic that reaches its interface. On a switched network that is normally just your own traffic and broadcasts, so capturing someone else's conversation requires a monitor port on the switch — a fact that is both a practical obstacle and a genuine security property.

Syllabus points

SNMP: manager, agent, MIB
MRTG and PRTG monitoring
Packet Tracer (simulation)
Wireshark (packet capture/analysis)

Create a free account to tick topics off, take notes as you read, watch the video lessons and get a day-by-day study plan built around your exam date.