Netwatch: Monitoring Network Connections

Table of Contents#

What is Netwatch?
Why Monitor Network Connections?
Types of Netwatch Tools
MikroTik Netwatch in RouterOS
Common Monitoring Practices
Best Practices for Network Monitoring
Practical Examples
Conclusion
References

What is Netwatch?#

Netwatch refers to network monitoring utilities that track the status of hosts and connections in real time. The most widely recognized implementation is MikroTik Netwatch, a built-in tool in RouterOS that monitors host availability using multiple probe types and can execute arbitrary scripts when host states change.

Other implementations include standalone command-line tools and open-source projects that provide similar functionality for monitoring established connections, tracking bandwidth, and sending alerts when thresholds are exceeded.

Why Monitor Network Connections?#

Monitoring network connections provides several critical benefits:

Early Issue Detection: Identify connectivity problems, packet loss, and latency spikes before they impact users. Proactive monitoring reduces mean time to resolution (MTTR).
Performance Optimization: Track bandwidth utilization and identify bottlenecks. Understanding traffic patterns helps with capacity planning and load balancing.
Security Awareness: Detect unauthorized connections, unusual traffic patterns, and potential security threats. Monitoring can reveal compromised hosts participating in botnets or data exfiltration.
Compliance Requirements: Many industries require documented network monitoring for regulatory compliance. Continuous monitoring provides audit trails and proof of service level agreements (SLAs).
Failover Automation: Netwatch tools can trigger automatic failover when primary connections fail, ensuring business continuity.

Types of Netwatch Tools#

MikroTik Netwatch#

The most feature-rich implementation, built into MikroTik RouterOS. Supports ICMP, TCP, HTTP/HTTPS, and DNS probes with configurable thresholds and script execution on state changes.

Command-Line Netwatch Tools#

Standalone utilities like the Rust-based netwatch (available via Homebrew or Cargo) provide terminal-based network diagnostics including interface monitoring, connection tracking, DNS analysis, and bandwidth measurement with a TUI (terminal user interface).

Open-Source Monitoring Projects#

GitHub projects like NetWatch provide Python-based monitoring that tracks established connections and sends email alerts when connection counts exceed configured thresholds.

MikroTik Netwatch in RouterOS#

MikroTik Netwatch is the most commonly referenced netwatch tool. Since RouterOS 7.4, Netwatch supports multiple probe types beyond basic ICMP ping:

Probe Types#

Probe Type	Description	Default Port
ICMP	Ping-style probe with advanced metrics (jitter, packet loss, standard deviation)	N/A
TCP-Conn	Tests TCP three-way handshake	80
HTTP-GET	Sends HTTP request and validates response codes	80
HTTPS-GET	Sends HTTPS request with optional certificate validation	443
DNS	Sends DNS query and validates response	N/A
Simple	Basic ICMP probe for backward compatibility	N/A

Key Configuration Properties#

/tool/netwatch
add host=8.8.8.8 type=icmp interval=10s timeout=3s \
   up-script=":log info \"Host is up\"" \
   down-script=":log info \"Host is down\""

Important properties:

host — IP address or domain name to monitor
type — Probe type (icmp, tcp-conn, http-get, https-get, dns, simple)
interval — Time between probes (default: 10s)
timeout — Maximum wait time for response (default: 3s)
up-script — Commands to execute when host comes up
down-script — Commands to execute when host goes down
test-script — Commands to execute after every probe test

ICMP Probe Thresholds#

For ICMP probes, you can configure fail thresholds:

thr-avg — Average round-trip time threshold (default: 100ms)
thr-max — Maximum RTT threshold (default: 1s)
thr-loss-percent — Packet loss percentage threshold (default: 85%)
thr-jitter — Jitter threshold (default: 1s)
thr-stdev — Standard deviation threshold (default: 250ms)

Advanced Features#

Early failure detection: Set early-failure-detection=yes to change probe status before all packets are processed if failure is already certain.

TTL-based monitoring: Use accept-icmp-time-exceeded=yes with a low TTL value to monitor internet connectivity without relying on a specific endpoint. This is useful when the target IP might filter ICMP requests.

Common Monitoring Practices#

Host Availability Monitoring#

Configure Netwatch to ping critical servers and services. When a host becomes unreachable, execute scripts that log the event, send notifications, or trigger failover procedures.

WAN Failover#

A common use case for MikroTik Netwatch is automatic WAN failover. Configure Netwatch to monitor a reliable external host (such as a root DNS server) via the primary WAN. If connectivity fails, disable the primary route and traffic flows through the secondary WAN.

Connection Threshold Monitoring#

Use tools like the Python-based NetWatch to track the number of established network connections. When connections exceed a configured threshold, send email alerts to administrators.

Service Health Checks#

Monitor specific services using TCP or HTTP probes. Verify that web servers respond with expected HTTP status codes, or that DNS servers respond to queries within acceptable timeframes.

Best Practices for Network Monitoring#

1. Define Clear Monitoring Goals#

Identify key performance indicators (KPIs) such as uptime, latency, throughput, and packet loss. Establish baselines for normal operation before setting alert thresholds.

2. Choose Appropriate Probe Types#

Match probe types to the services you monitor. Use HTTP probes for web servers, DNS probes for name servers, and ICMP probes for general connectivity checks.

3. Set Realistic Thresholds#

Default thresholds may not suit your environment. Adjust based on your network's baseline performance to avoid false positives while still catching genuine issues.

4. Implement Escalation Procedures#

Create a systematic process for responding to alerts. Define what constitutes a critical alert, who should be notified, and what actions to take.

5. Monitor Multiple Layers#

Track performance at different network layers. Monitor physical connectivity, transport layer (TCP/UDP), and application layer services for comprehensive visibility.

6. Use Proactive Monitoring#

Don't wait for users to report problems. Configure monitoring to detect issues early and trigger automated responses when possible.

7. Regularly Review and Update#

Network environments change constantly. Review monitoring configurations regularly to ensure they remain relevant and effective.

8. Avoid Alert Fatigue#

Configure alerts strategically to prevent notification storms. Filter out false positives and prioritize alerts that require action.

Practical Examples#

Example 1: Basic Host Monitoring with MikroTik#

Monitor Google's DNS server and log status changes:

/tool/netwatch add host=8.8.8.8 type=icmp interval=30s \
   up-script=":log info \"Google DNS reachable\"" \
   down-script=":log warning \"Google DNS unreachable\""

Example 2: WAN Failover Configuration#

Monitor an external host via the primary WAN and disable the route on failure:

# Add Netwatch entry for primary WAN monitoring
/tool/netwatch add host=192.5.5.241 type=icmp interval=10s \
   down-script="/ip route disable [find comment=\"primary-wan\"]" \
   up-script="/ip route enable [find comment=\"primary-wan\"]" \
   comment="wan-monitor"

Example 3: Web Server Health Check#

Monitor a web server with HTTP probe and validate response:

/tool/netwatch add host=192.168.1.100 type=http-get port=443 \
   http-code-min=200 http-code-max=299 \
   thr-http-time=5s \
   down-script=":log error \"Web server down\"" \
   up-script=":log info \"Web server restored\""

Example 4: DNS Server Monitoring#

Verify that a DNS server responds correctly:

/tool/netwatch add host=example.com type=dns \
   dns-server=1.1.1.1 record-type=A \
   down-script=":log warning \"DNS resolution failing\""

Conclusion#

Netwatch tools provide essential network monitoring capabilities for maintaining reliable connectivity. Whether you use MikroTik's built-in Netwatch for router-level monitoring, command-line tools for terminal-based diagnostics, or open-source projects for connection tracking, the key is to implement monitoring that aligns with your network's specific needs.

By following best practices—defining clear goals, choosing appropriate probe types, setting realistic thresholds, and implementing escalation procedures—you can detect issues early, optimize performance, and ensure your network connections remain stable and secure.