OUTSOURCED NETWORK MONITORING: WEEK-ONE CHECKLIST | ITcare
A network that has been stable for three years is not one we trust yet. Stable often just means nobody has touched the part that is quietly broken.
That assumption shapes how we run every outsourced network monitoring engagement. When we take over monitoring for a new ISP, data center, hosting provider, or WISP, the first week is not about lighting up dashboards. It is about finding the failures that have not happened yet. Green graphs from day one prove nothing except that the collector is reachable. Trust is built by checking the things no status page shows.
Here is what week one actually covers.
The Outsourced Network Monitoring Week-One Checklist
1. Management Plane Exposure
SSH and SNMP reachable from the public internet, no VTY ACLs, no control plane policing. Everything works fine right up until it very much does not. This is the single most common finding across new engagements, and it is invisible to conventional monitoring because nothing is down. The fix costs an afternoon. The absence of the fix costs a compromised router at the worst possible time.
2. BGP Policy, Not BGP State
Not whether the sessions are up. We look at the policies. Are inbound prefixes from peers and customers actually filtered, or is the session accepting whatever shows up? Is there a max-prefix limit on every eBGP session? Do the outbound policies announce only what they should, or is the network one missing filter away from leaking transit between two providers? We check it against MANRS as a baseline, because most setups follow it on paper and not in the config. A session that has been Established for 400 days tells you nothing about what it will accept on day 401.
3. NTP
Boring, ignored, and the reason half of incident timelines are useless. If the edge routers and the syslog server disagree on what time it is, every correlation made during an outage is fiction. Week one includes verifying that every device syncs against the same reliable sources and that syslog timestamps actually line up across the network. Nobody notices until the night it matters.
4. Config Backups That Restore
When was the last backup, and does running-config still match startup-config? A box that has not rebooted in two years often will not survive the next reboot, because the running state drifted from anything saved. We verify the backups exist, are current, and diff cleanly against what is actually running. A backup nobody has tested is a theory.
5. Redundancy That Only Exists on Paper
Two upstreams is not redundancy if the failover was never tested. We check whether the upstream paths are actually set up to fail over on their own, whether there is internal path diversity through the route reflectors and alternate paths across the network, and whether those alternate paths are genuinely alive and able to carry traffic, not waiting on someone to trigger the switch by hand. Redundancy is a verified behavior, not a diagram.
6. Optical and RF Health
DOM readings on every uplink. Marginal transceivers throw CRC errors long before they fail outright, and the errors get blamed on everything except the optic. For WISPs we go further and check whether the wireless links are actually monitored: RSSI, SNR, modulation rate, retransmits, and capacity headroom, so signal degradation is caught as a trend, before it becomes a customer-down ticket.
What Week One Actually Delivers
None of this shows up as red on a status page. That is the point. Most of these findings are also invisible to a monitoring stack running on defaults, which is why polling and alerting design come next; we covered that side in our network monitoring best practices post.
The deliverable at the end of the first week of an outsourced network monitoring engagement is not a dashboard. It is a written list of how this specific network breaks, ranked by customer impact, with the quiet failures surfaced before they get to introduce themselves. From there, our 24/7 managed NOC is watching a network we understand, not just a network we can see.
By the end of the first week we are not monitoring a network. We understand how it breaks.
