What is a NOC (Network Operations Center)?
A NOC (Network Operations Center) is the team that monitors a network 24/7, responds to incidents and outages, and runs escalation by defined procedures.
Last updated:
A NOC (Network Operations Center) is the team and facility that continuously monitors a network, detects outages, and coordinates incident response. From a single point the operator watches the state of links, routers, BGP sessions, and traffic, so that a problem is caught before customers feel it and then driven to resolution by defined procedures. A NOC typically runs 24/7/365. It is the first line of defense for service availability and the contact point for network reports.
24/7 monitoring
The core of NOC work is continuous monitoring built on several data sources. Systems collect metrics, telemetry, and logs, compare them with a baseline, and raise alarms when parameters cross a threshold. On-call engineers watch dashboards and the alarm queue, separating meaningful events from noise.
- SNMP and streaming telemetry (for example gNMI) to read link load, interface errors, and device health.
- NetFlow, IPFIX, and sFlow flow analysis to detect traffic anomalies and volumetric attacks.
- BGP session and route monitoring: flapping, lost adjacencies, unexpected AS_PATH changes.
- Active probes: ping, traceroute, MTR, and measurements of latency and packet loss between locations.
- Alarm correlation and notifications (email, SMS, integrations) with escalation to the on-call engineer.
Incident response
Once a problem is detected, the NOC starts the incident-handling process: it confirms the event, classifies its severity, locates the cause, and takes corrective or mitigating action. Time to respond and time to restore service both matter, so engineers rely on prepared procedures (runbooks) for common failures, such as switching a link, re-establishing a BGP session, or triggering DDoS defenses like RTBH or FlowSpec. Every incident is logged in a ticketing system, and after it is closed a post-mortem analysis is often produced.
Escalation and SLA
Escalation is the path by which a ticket is handed onward when the first line does not resolve it within a set time. Functional escalation goes to more experienced engineers or specialists in a given technology, and hierarchical escalation goes to management when an incident has significant business impact. Escalation procedures tie back to the SLA, which states the provider's commitments: target availability (for example 99.9 percent), time to respond to a report, and time to repair. The NOC makes sure these targets are met and communicates incident status to customers and to the operators it works with, including peering and transit partners.
The NOC at AS202520 SkyPass
AS202520 SkyPass runs monitoring and event handling for its network, with PoPs in Warsaw and Wrocław and peering at Polish internet exchanges: THINX, TPIX, WRIX, and 1-IX. This covers oversight of the BGP sessions of IP transit and peering customers, response to connectivity incidents, and activation of DDoS protection when a volumetric attack is detected. The state of routes and latency can also be verified independently in the public looking glass, and response and escalation procedures are tied to the SLA parameters agreed for a given service.
Frequently asked questions
How does a NOC differ from a SOC?
A NOC handles network availability and performance: outages, links, BGP sessions, latency. A SOC (Security Operations Center) focuses on security, that is detecting and responding to threats and breaches. The teams often cooperate, for example during DDoS attacks.
What does 24/7 monitoring mean?
It means uninterrupted oversight of the network around the clock, 7 days a week, 365 days a year, with on-call engineers and alarm systems ready to react at any time, including nights and holidays.
What is escalation in a NOC?
It is handing a ticket onward when the first line cannot resolve it within a set time. Functional escalation routes the case to specialists, while hierarchical escalation goes to management when the incident has high impact.
How does a NOC relate to the SLA?
The SLA defines target availability and the times to respond and to repair. The NOC delivers those commitments in practice: it detects the incident, runs response and escalation, and reports status to meet the agreed deadlines.