Every other family in this catalogue does something to traffic. This one only watches, and the constraint that shaped it is that watching must not become a burden on the thing being watched.

1987 to 1988: keep it simple, and make it temporary

Before it, each manufacturer used proprietary protocols to manage its own equipment, so an estate with three vendors needed three management systems. The Internet Activities Board started work in 1987 on something standard.

1067, published August 1988 by Jeffrey Case, Mark Fedor, Martin Schoffstall and James Davin, defined the Simple Network Management Protocol. It was not backwards compatible with its predecessor, the Simple Gateway Monitoring Protocol, and the memo says why the changes were kept minimal: the board had directed the working groups to be extremely sensitive to the need to keep simple.

Two facts about that document decide everything after.

It was meant to be temporary. Version 1 was intended as an interim solution, and its simplicity and effectiveness made it permanent instead.

Its acknowledgements are a map of this catalogue. The working group that shaped it included James Davin of Proteon, Anthony Chung of Sytek, Ramesh Babu of Excelan, Amatzia Ben-Artzi of 3Com/Bridge, Phill Gross of , Greg Satz of Cisco, Marshall Rose in the chair and Keith McCloghrie of the Wollongong Group. Nearly every company in that list has an entry in this catalogue and most of them no longer exist. The companies dissolved and the document they wrote is still in production, which is the specification-outlives-product pattern stated as plainly as it ever gets.

What it actually established

The protocol is the small part. What lasted is the model.

The managed object. Devices expose a hierarchy of named values - the management information base - defined in a formal notation, so a manager can ask any device for a value without knowing what the device is. That is the idea that killed the three-management-systems problem.

Polling, not pushing. A manager asks; the device answers. It puts control of the load on the observer and keeps the device stupid, which was correct for equipment with tiny processors and is the root of every scaling complaint since.

Four operations and a trap. Get, get-next, set, and an unsolicited notification. The memo argues explicitly for limiting unsolicited messages, to minimise traffic generated by the management function itself.

And a deliberate refusal. The design excluded imperative commands: rather than a reboot command, you set a value that causes a reboot. Management should describe state, not issue orders - which is the same principle that intent-based systems in the SDN article rediscovered thirty years later.

The security that never arrived

Version 1 authenticated with a community string sent in the clear, and RFC 1067 was honest that effective management of administrative relationships requires real authentication.

Work on version 2 began in 1992. It attempted to fix security, and the complexity of the security enhancements led to its demise - the fix failed because it was too complicated to adopt, and version 1 stayed. Version 3 eventually delivered a real user-based security model, and by then a generation of devices, tools and habits had been built around the version that had none.

This is the clearest case in the corpus of the mechanism named in the obsolescence article: the cost of replacing exceeded the perceived risk, so a known weakness ran for decades. The community string persisted not because anyone defended it but because everything already worked, the exposure was mostly internal, and the replacement was harder than the problem.

The one place it did get punished is amplification. A protocol that answers a small question with a large reply, over a connectionless transport that permits forged sources, is a gift to anyone building a denial-of-service attack - and that is what finally moved operators, more than the authentication argument ever did.

From polling to streaming

Polling degrades in a specific way: to see a device more often you ask more often, and the observer's load grows with the product of devices and metrics and frequency. At estate scale that stops working.

Streaming telemetry inverts it. The device pushes structured data continuously to a collector, on its own schedule, in a defined format. It moves the cost to the device that has the information, removes the interval as the limit on resolution, and turns monitoring into a data pipeline problem rather than a query problem.

Logs, metrics and traces then became the standard framing, with tracing arriving from distributed systems rather than from networking - because when a request crosses forty services, knowing that each is healthy tells you nothing about why the request was slow.

The word observability itself marks the shift, and the distinction it is meant to carry is worth stating exactly: monitoring answers questions you thought of in advance, and observability is the claim that you can ask new ones afterwards. Whether a given deployment delivers that is a question about data retention and cardinality, not about a product name.

Jobs and practices

This family created the network operations centre and the discipline of watching, and its practices are shaped by one permanent problem: there is always more data available than anyone can look at.

Baselining, because a number means nothing without knowing what normal was. Thresholds and their futility, since a static threshold is either noisy or blind and usually both at different hours. Correlation, which exists because one fault produces fifty alarms and the operator needs the cause rather than the census. And the runbook attached to the alert, which is the difference between a monitoring system and a paging system.

Its defining pathology is the same one the intrusion detection article names: alert volume exceeding human attention. Both families independently discovered that the constraint is not detection, it is who reads the output - and both responded by building correlation layers on top rather than by generating less.

The companies

The protocol came from universities and research networks and was given to everyone. The commercial layer above it has churned continuously: the large management frameworks of the 1990s, the open lineage of Nagios, Cacti, Zabbix and their successors, the metrics platforms built around time-series databases, and the observability vendors selling ingestion by the gigabyte - which is the current business model and the current complaint.

Where it goes

The cost model became the design constraint. When observability is billed by volume, deciding what not to collect is an engineering decision with a budget attached, and sampling stops being a technical compromise and becomes a financial one.

Open instrumentation is winning. -neutral instrumentation standards mean the application is instrumented once and the backend is replaceable, which is the first time in this family's history that the data has not been captive to the tool that collects it.

Analysis is moving to the collector. Detecting anomalies in the pipeline rather than in a dashboard is the same migration the security families made, and it runs into the same question: what fraction of what is flagged does anyone act on.

And the founding trade is unchanged. Case and his co-authors were told to keep it simple and did, and simplicity is why it spread and why its security took fifteen years to arrive. Every generation of this family since has faced the same choice between being easy enough to deploy everywhere and being good enough to trust, and the historical record here says which one wins.

Sources