> ## Content Index
> Fetch the complete content index at: https://www.pinglabz.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Open Source Network Observability Tools: The Series
- URL: https://www.pinglabz.com/open-source-observability-tools-series/
- Published: 2026-11-03T20:11:35.000Z
- Updated: 2026-11-03T20:23:26.000Z
- Description: The hub for the PingLabz observability tools series: LibreNMS against Zabbix on the same devices, Netdisco for topology and MAC/ARP search, and Suricata and Zeek watching the management network.
- Author: Jaime
- Tags: Monitoring, Tools

This is the hub for a short PingLabz series on open source tools that sit next to your main monitoring system. It's three posts, built in my home lab on the same Cisco IOS XE 17.18.2 routers and switches I use in the Zabbix and Grafana series, all polled over SNMPv3.

The first post runs LibreNMS 26.10.2 and Zabbix 7.0.32 against the same devices with the same SNMPv3 credentials. I compare autodiscovery, the graphs you get out of the box, a real BGP alert test and measured memory use. Neither tool wins outright, and the post says where each one fits better.

The second post covers Netdisco 2.117001\. You give it one seed router and it finds the rest through CDP. Then you get MAC and ARP search, which answers "which port is this host on?" in seconds, and a neighbour map. I also say what a small lab can't show you about how it behaves on a large network.

The third post moves from monitoring to security. I mirrored the management network into Suricata 8.0.3 and Zeek 9.0.0, shipped their logs through Grafana Alloy into Loki, and set up a Grafana alert for anything outside the NOC that touches router management. It includes the tuning I needed and the gotchas I ran into.

Each post works on its own. Together they cover three questions your NMS usually can't answer well: is there a better tool for this job, where is that device plugged in, and who is talking to my routers' management interfaces?

![Diagram: Open source observability tools. The same IOS XE routers and switches, highlighted, feed three posts: LibreNMS versus Zabbix over SNMPv3, Netdisco answering where a device is plugged in, and Suricata with Zeek on a mirror of the management network answering who touches it. IDS alerts flow through Alloy into Loki and onto a Grafana alert.](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/11/hub-open-source-observability-tools-series.png)

## The series in reading order

1. [LibreNMS vs Zabbix on Cisco IOS XE: Same Devices, Same SNMPv3, Honest Results](https://www.pinglabz.com/obs-librenms-vs-zabbix/). Same devices, same SNMPv3: discovery, graphs, a BGP alert test and measured memory.
2. [Netdisco on Cisco IOS XE: CDP Topology, MAC and ARP Search over SNMPv3](https://www.pinglabz.com/obs-netdisco-topology/). CDP topology from one seed router, plus MAC and ARP search.
3. [Suricata and Zeek on the Management Network: IDS Alerts in Grafana and Loki](https://www.pinglabz.com/obs-suricata-zeek-noc/). IDS on a mirrored management network, logs in Loki and alerts in Grafana.

## Where to start

Who this is for: engineers who already have an NMS and want to fill its gaps. Start with whichever question you're facing today. For the core monitoring stack, see the [Zabbix](https://www.pinglabz.com/zabbix-network-monitoring-series/) and [Grafana](https://www.pinglabz.com/grafana-network-monitoring-series/) series.