Noc Theory and Practice Timothy Brown Independent Consultant

Noc Theory and Practice Timothy Brown, Independent Consultant Matthew F. Ringel, Akamai Technologies, Inc.

Introduction “So you want to build a NOC? ” Two parts: theory and practice n n Theory: the functional components of a NOC, and how they’re put together. Practice: the organizational details that make a NOC work on a day-to-day basis.

Part I: NOC Theory Taking It Apart, Putting It Back Together.

Definitions What is a NOC? n A network operations center (NOC), is an organizational unit that: w Handles day-to-day monitoring of the network w Serves as a point of contact for customers, internal and external w Creates, processes, and sometimes resolves events that arise in the network

Overview All NOCs have things in common, regardless of size Who and where are the customers? n Internal vs. external SLAs shape the infrastructure as well

The Model Inputs n n “Something has happened” Event sources w Monitoring programs n (e. g. HPOV, Netcool, netsaint, etc. )

The Model (Cont’d) Outputs n n “We have taken care of what happened. ” Event sinks w Fixing problems, handing off other issues to be resolved by others

The Model (Cont’d) Process n n n The actions in the middle while and event is being worked Two schools of thought w NOC as first-level tech w NOC as dispatchers only Ticketing systems w Life-cycle of an event

Scaling and Portability Large variety of scale n NORAD vs. “Two guys in a cage”. Portability n n Can you pick up and monitor somewhere else? Integral to Disaster recovery

Example: Bare-Bones NOC Are all the functions there?

Example: NORAD-style NOC Are all the functions there?

The Portable NOC The definition of NOC says nothing about location NOC isn’t just a set of big screens with blinkenlights. “Go home and monitor!” Distributed functions

Model of the Portable NOC Are all the functions there? n n n Inputs Outputs Services

Evaluation: Portable NOC Organizational Unit, independent of location. Centralized event sources and sinks with distributed observers Diminished intra-NOC communications, but sufficient for emergency.

Conclusion A NOC is not just a place n It’s a set of inputs, outputs and processes that are accomplished by people. Function is similar regardless of scale Portability is important n And it emphasizes the functional divisions

Next- Part 2: The Nuts & Bolts