Design Network Monitoring - System Design | WinJob

NPMD Mission: Flow Telemetry and Threat Surfaces

Design a network performance and security monitoring (NPMD) platform (ExtraHop/Darktrace/Cisco-class) for hybrid enterprises: passive flow telemetry, entity graph analytics, MITRE-aligned detections, and SOC-ready exports. This section covers npmd mission: flow telemetry and threat surfaces in the understanding phase.

Why interviewers probe here

Staff+ loops at Darktrace, ExtraHop, and Cisco expect you to connect wire visibility, baseline seasonality, and encrypted-traffic strategy—not a box labeled "monitoring". Lead with SPAN coverage math, ingest Gbps, and MTTD before vendor names.

Mechanism and operations

Mechanism for NPMD Mission: Flow Telemetry and Threat Surfaces: separate passive flow capture from active endpoint agents so encrypted east-west blind spots are explicit. Ingest partitions Kafka by tenant_id and site_id; normalizers attach asset_id from CMDB; rule engine emits OCSF alerts with suppression fingerprints; hunt UI queries hot Neo4j-compatible graph for 7d then federates cold Parquet.

Failure drills

Failure drills (NPMD Mission: Flow Telemetry and Threat Surfaces): if SPAN drops exceed 0.01% for 5m, throttle non-critical exporters and page platform. If baseline trainer sees concept drift after DC migration, freeze promotions and run shadow mode 48h. If SIEM export lag > 300s, shed tier-3 alerts and expand consumer group. If DPI enclave CPU > 85%, disable payload mode and keep metadata path only.

Interview checkpoints (unique to this section)

Signal	Target
Peak flow records/s	1.8M
Ingest Gbps (mirrored)	320
Hot graph retention	7 days
MTTD tier-1	< 8 min

javaOne Dark Pro

1 public final class FlowKey1 {
2   public String canonical(String srcIp, int srcPort, String dstIp, int dstPort, String proto) {
3     if (srcIp.compareTo(dstIp) > 0) return dstIp + ":" + dstPort + "->" + srcIp + ":" + srcPort + "/" + proto;
4     return srcIp + ":" + srcPort + "->" + dstIp + ":" + dstPort + "/" + proto;
5   }
6 }

pythonOne Dark Pro

1 def beacon_score(intervals: list[float], tolerance: float = 0.15) -> float:
2     if len(intervals) < 5:
3         return 0.0
4     mean = sum(intervals) / len(intervals)
5     variance = sum((x - mean) ** 2 for x in intervals) / len(intervals)
6     return 1.0 - min(1.0, (variance ** 0.5) / (mean + 1e-6))

typescriptOne Dark Pro

1 export interface NpmdAlert {
2   ruleId: string;
3   mitreTechnique: string;
4   entityIds: string[];
5   severity: number;
6 }
7  
8 export function suppressFingerprint(alert: NpmdAlert): string {
9   return alert.ruleId + ":" + alert.entityIds.sort().join("|");
10 }

Why interviewers care

Network Monitoring interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for NPMD Mission: Flow Telemetry and Threat Surfaces that proves you understand real outages, not happy-path diagrams.

Key Highlights

•NPMD Mission
•Phase understanding — separate passive flow capture from active endpoint agents so…
•Flow records/s and Gbps math before storage brands

1	public final class FlowKey1 {
2	public String canonical(String srcIp, int srcPort, String dstIp, int dstPort, String proto) {
3	if (srcIp.compareTo(dstIp) > 0) return dstIp + ":" + dstPort + "->" + srcIp + ":" + srcPort + "/" + proto;
4	return srcIp + ":" + srcPort + "->" + dstIp + ":" + dstPort + "/" + proto;
5	}
6	}

1	def beacon_score(intervals: list[float], tolerance: float = 0.15) -> float:
2	if len(intervals) < 5:
3	return 0.0
4	mean = sum(intervals) / len(intervals)
5	variance = sum((x - mean) ** 2 for x in intervals) / len(intervals)
6	return 1.0 - min(1.0, (variance ** 0.5) / (mean + 1e-6))

1	export interface NpmdAlert {
2	ruleId: string;
3	mitreTechnique: string;
4	entityIds: string[];
5	severity: number;
6	}
7
8	export function suppressFingerprint(alert: NpmdAlert): string {
9	return alert.ruleId + ":" + alert.entityIds.sort().join("\|");
10	}