Network monitoring deck
A small simulated ISP topology with SNMP agents on every node. Inject faults, watch the alert engine fire, dedup, and suppress collateral damage when the parent uplink dies — the same parent-down correlation that's the win in a production LibreNMS alert transport.
What's happening:
Seven simulated devices in a typical ISP shape — one core, two distribution switches, four access switches. Every 5s sim time the poller hits each device's SNMP agent and records sysUpTime, sysCpuUtil, and per-interface ifInOctets / ifOutOctets / ifInErrors.
Counter32 values wrap at 2³² like real SNMP; the poller computes deltas across the wrap correctly.
Try this:
- 1Click any device, then hit CPU spike. After 2 consecutive bad polls it fires
cpu-high. - 2Click dist-sw-east and hit Unreachable.
device-unreachablefires. - 3Now click acc-sw-1 (a child of dist-sw-east) and hit CPU spike. Watch the alert appear in the feed marked SUPPRESSED — the parent is already down, so this is collateral damage, not a separate page.
- 4Wait 60s sim time for faults to auto-clear, or hit reset.
Why this matters:
On a real ISP network a single backbone outage can fan into 40+ alerts in 90 seconds — every CPE downstream goes unreachable, every access switch loses its uplink, every monitoring rule fires.
The transport layer's job is to know which alerts are causes and which are consequences, page once on the cause, and log the rest as collateral. That's what the suppression you see firing here is doing — and what the 40% incident-response improvement is built on.
No alerts in this view. Try a playbook above or inject a fault on the selected device.