Network Monitoring and Outage Alerting Dashboard for Small ISPs
Build a NOC dashboard for a small internet service provider that polls routers and switches over SNMP, collects syslog, groups related alarms into one outage, and shows which areas and how many customers are affected. Field staff get the right alert on their phone, and the NOC gets a timeline of every incident. A network operations final year project with real users.
Intermediate
A small team, or one strong student willing to learn something new.1 semester · 2 to 3 students
8 to ship
4 optional extrasSuggested stack
What you should ship
- A test network of at least 12 routers and switches representing a core, distribution points and customer areas
- SNMPv3 polling of interface status, traffic, errors, CPU and memory every minute
- A syslog receiver that stores and classifies messages by device and severity
- A topology model linking each area and customer group to the devices and links that serve it
- Alarm correlation: when an upstream link fails, the downstream alarms are grouped into one outage with a probable cause
- A dashboard with a live tree of areas, current outages, affected customer counts and 24-hour graphs
- Alert routing to the on-call field engineer by email or a chat app, with acknowledgement
- An incident timeline and a monthly availability report per area
If you have time left
- Flow data to show top talkers and detect sudden traffic drops or floods
- Planned maintenance windows that suppress alerts for the affected devices
- A customer-facing status page that shows only area-level status
- Anomaly detection on interface traffic to warn before a link saturates
The problem: many alarms, one outage, angry customers
Small ISPs and cable internet operators serve neighbourhoods, towns and business parks through a few core routers, many distribution switches and a lot of fibre or wireless links. When one upstream link fails, dozens of downstream devices go unreachable at once, and a basic monitoring tool fires dozens of separate alarms. The NOC engineer has to work out which one is the cause, which areas are down and which field technician to send, while the phones ring. Many small operators run on free tools, spreadsheets and phone calls.
What already exists and the gap
- LibreNMS and Zabbix are capable open source monitoring systems with SNMP polling, graphs and alerting.
- PRTG and similar commercial products offer polished dashboards, priced by the size of what you monitor.
- Prometheus with the SNMP exporter and Grafana is a popular do-it-yourself stack.
- ntopng and similar tools analyse flow data.
These tools monitor devices well. The gap is the ISP's point of view: grouping alarms into one outage with a probable root cause, mapping it to areas and customer counts, routing it to the right field engineer and producing availability reports per area, without months of configuration.
Inspiration
Large telecom operators run network operations centres with event correlation, where alarms are grouped by topology so the root cause surfaces first. This project brings that idea to a small operator's scale, using the standard protocols every network device supports: SNMP, syslog and flow export.
What you build
- NOC engineer: sees current outages, not raw alarms; opens one to see the probable cause, affected areas and timeline.
- Field engineer: receives an alert for their region, acknowledges it and adds notes.
- Manager: reads monthly availability per area and the longest outages.
Main flows: polling and log collection, alarm correlation, alerting and acknowledgement, incident timeline, monthly report.
The technically interesting part
- Polling at scale. Poll many devices every minute with SNMPv3, handle timeouts and store time series efficiently.
- Topology-aware correlation. Model which devices sit behind which links. When a device and everything behind it go silent together, raise one outage on the upstream link instead of many alarms, and explain why.
- Syslog classification. Parse messages such as link down, neighbour down and high temperature, and attach them to the right incident.
- Test network as code. Build the ISP network in Containerlab or GNS3, then script failures (links down, devices off, flapping interfaces) to test correlation repeatably.
How to evaluate it
- Correlation accuracy: on 30 scripted failures, how often the probable cause shown is the real one.
- Noise reduction: number of alarms raised compared with a plain per-device monitor on the same failures.
- Time to alert: seconds from a link failing to the field engineer's notification.
- Usability: a short test with network students or a working NOC engineer, timing how quickly they identify the affected areas.
Suggested plan
- Weeks 1 to 3: test network as code, SNMPv3 polling, storage.
- Weeks 4 to 6: syslog receiver, topology model, dashboard basics.
- Weeks 7 to 9: correlation engine and scripted failure tests.
- Weeks 10 to 12: alert routing, acknowledgement, timelines.
- Weeks 13 to 15: reports, evaluation, write-up and demo.
Path to a product
Small ISPs, cable operators, campus networks and managed service providers need a NOC view but cannot staff one around the clock. A product that sets up quickly on their existing devices and turns alarms into outages with customer impact could be sold per network or per device, with a hosted option. Start with one local ISP willing to run it alongside their current tool.
Scope warning
Do not poll a real ISP's production network without written permission and read-only SNMPv3 credentials. Keep the core project in your lab. Do not build your own flow collector from scratch; if you reach the flow stretch goal, use an existing collector and focus on correlation.
Learn what you need on Sefism
- Network engineering roadmap: routing, the automation and monitoring stage, and what NOC work looks like.
- Network engineering cheat sheet: SNMP, syslog severities, flow logs, show commands and troubleshooting method.
- Containerlab: build and break the ISP test network from a YAML file.
- GNS3: an alternative lab with real router images.
- Wireshark User's Guide: inspect SNMP and syslog packets while you debug.
- Netmiko: pull extra detail from devices when an incident opens.
Get help with this idea
The hard part is the correlation logic, not the charts. Tauseef can help you design the topology model and the failure tests so the core result is measurable. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.