Network Services (NTP, SNMP, Syslog, CDP/LLDP, QoS) Explained for CCNA

Some of the most important things a network does happen in the background, invisible to users until they break. NTP keeps device clocks synchronized so logs from different devices correlate correctly. SNMP allows network management systems to monitor device health and receive alerts. Syslog sends log messages to a central collector so you can trace events across dozens of devices from one place. CDP and LLDP let you discover what is connected where without walking the data center floor. CCNA tests the syslog severity numbers, SNMP versions, and NTP stratum hierarchy with enough regularity that memorizing the specifics is worth your time.

8 min

3 sections · 6 exam key points

NTP and SNMP

Network Time Protocol (NTP) synchronizes clocks across network devices. Accurate time matters more than it sounds: when you correlate log files from a router, a switch, and a firewall to trace an attack, events that are off by even a few seconds become impossible to sequence correctly. NTP also affects certificate validation, authentication protocols, and scheduled tasks.

NTP uses a stratum hierarchy. Stratum 0 devices are atomic clocks and GPS receivers that do not participate directly in the network. Stratum 1 servers are directly connected to stratum 0 sources and are the most accurate network-accessible time sources. Stratum 2 servers synchronize from stratum 1. Each hop adds a stratum number and introduces a tiny amount of timing error. Stratum 16 means unsynchronized. Lower stratum number means a more accurate source.

SNMP (Simple Network Management Protocol) has three components: a Manager (the NMS that collects data), Agents (running on each monitored device), and a MIB (Management Information Base, the database of variables the agent can report). SNMPv1 and v2c use cleartext community strings, public for read access and private for write access. SNMPv3 adds authentication (MD5 or SHA) and encryption (AES), making it the only version appropriate for production use.

SNMP Traps are unsolicited messages from agents to the manager when something noteworthy happens, like an interface going down. Traps are not acknowledged. SNMP Informs are like Traps but require acknowledgment from the manager. If no acknowledgment arrives, the agent resends.

Syslog, CDP/LLDP, and QoS basics

Syslog sends log messages from network devices to a central syslog server over UDP port 514. The severity level attached to each message tells you how serious it is. Level 0 (Emergency) means the device is unusable. Level 1 (Alert) requires immediate action. Level 2 (Critical) indicates a hardware failure. Level 3 (Error) covers interface errors. Level 4 (Warning) covers configuration warnings. Level 5 (Notice) is significant but normal events. Level 6 (Informational) includes link state changes. Level 7 (Debug) is verbose output for troubleshooting. Remember the mnemonic: Every Awful Crisis Eventually Wears Nobody Down.

CDP (Cisco Discovery Protocol) is a Cisco-proprietary Layer 2 protocol that is on by default on all Cisco interfaces. It lets switches and routers learn directly connected neighbors' hostname, IP address, platform, IOS version, and native VLAN. Very useful for troubleshooting but a security risk on externally facing interfaces because it reveals device details. Disable it per interface with no cdp enable or globally with no cdp run.

LLDP (Link Layer Discovery Protocol, IEEE 802.1AB) is the open-standard equivalent of CDP. It works across multi-vendor environments. Disabled by default on some Cisco devices. Enable globally with lldp run.

QoS (Quality of Service) prioritizes delay-sensitive traffic like voice and video. Classification identifies traffic types. Marking stamps them with priority values (DSCP EF 46 for voice). Queuing serves high-priority traffic first. LLQ creates a strict priority queue for voice so it is always dequeued first. DSCP EF (Expedited Forwarding, value 46) marks voice traffic.

How to choose the correct answer

NTP stratum: lower number = more accurate. Stratum 1 is the most accurate network source. Stratum 16 = unsynchronized. NTP uses UDP port 123.

SNMP version for production: SNMPv3 authPriv. This is the only version with both authentication and encryption. SNMPv2c community strings are plaintext.

Syslog severity: lower number = more severe. Emergency (0) = worst. Debug (7) = least severe. Setting logging trap warnings sends levels 0 through 4 to the syslog server.

CDP vs LLDP: CDP = Cisco-only, on by default. LLDP = open standard, may need enabling. Both discover Layer 2 neighbors only, do not cross routers.

SNMP Trap = no acknowledgment. SNMP Inform = acknowledged, resent until confirmed.

Syslog severity levels

Level	Name	Examples
0	Emergency	System completely unusable
1	Alert	Immediate action needed
2	Critical	Hardware failure, critical error
3	Error	Interface errors, configuration errors
4	Warning	Configuration warnings
5	Notice	Normal but significant events
6	Informational	Interface link state changes
7	Debug	Verbose debugging output

Key exam facts — CCNA

NTP stratum: lower = more accurate. Stratum 1 = synced from atomic/GPS. Stratum 16 = unsynchronized. UDP 123.

SNMPv1/v2c = plaintext community strings. SNMPv3 authPriv = authentication + encryption only production-safe version.

SNMP Trap = no acknowledgment. Inform = acknowledged and resent until confirmed.

Syslog: 0 = Emergency (most critical). 7 = Debug (least critical). UDP port 514.

CDP = Cisco-only, Layer 2, on by default. LLDP = open standard (IEEE 802.1AB), multi-vendor.

DSCP EF (value 46) marks voice traffic. LLQ provides strict priority queue for voice.

Common exam traps

A higher syslog severity number indicates a more critical event.

Syslog works in reverse from what the word 'level' might suggest. Level 0 (Emergency) is the most critical. Level 7 (Debug) is the least critical. This trips up many candidates. Lower number = more severe.

SNMPv2c is secure enough for monitoring production networks.

SNMPv2c transmits community strings in plaintext. Anyone capturing network traffic can read the community string and use it to query or even write to device configurations. SNMPv3 with authPriv is the only SNMP version that provides authentication and encryption suitable for production environments.

CDP and LLDP can discover devices across the network beyond directly connected neighbors.

CDP and LLDP are Layer 2 protocols. They discover only directly connected neighbors on the same segment. They do not traverse routers and cannot discover devices beyond one hop. They show you what is plugged into which port, not the entire network topology.