The 22nd SIG-NOC (Special Interest Group on Network Operations Centres) meeting convened in Prague, Czechia on April 2–3, 2025, under the theme “Follow the Flow.” Hosted by CESNET, the gathering brought together 25 on-site and 28 online network operations professionals from across Europe to discuss advancements in network monitoring and operational resilience.
The meeting commenced with a welcome from Jan Růžička (CESNET), setting the stage for a series of technical presentations and discussions. Jaroslav Svoboda from CESNET kicked off the meeting by detailing their network security scanning initiatives, emphasizing the importance of proactive threat detection. Following this, Carl Holt and Filip Cerny from Progress shared insights into flow analysis and monitoring detection, highlighting their decade-long collaboration with GÉANT’s SOC and the evolution of tools like Flowmon to enhance network visibility.
Flash talks provided additional perspectives, with Petr Hanousek (CESNET) presenting on CESNET’s NOC operations and Alexander Gall (Switch) discussing unsampled NetFlow generation at Switch, underscoring the value of granular traffic data for network analysis.
Tim Chown (Jisc) introduced the Scitags project which aims to improve the identification of research and education network traffic through innovative tagging methods, facilitating better traffic management and resource allocation. Subsequently, Olaf Verschoor (GÉANT) and Garvan McFeeley (HEAnet) addressed the complexities of procuring network equipment, the steps involved and shared strategies to navigate challenges in the current technological landscape. Wim Biemolt (SURF) concluded the first day by recounting experiences in managing DDoS events, emphasizing the need for robust mitigation strategies.
The second day continued with an update on EuroHPC’s hyperconnectivity initiatives by Sebastiano Buscaglione (GÉANT), outlining efforts to enhance high-performance computing infrastructure across Europe. Jože Hanc (ARNES) and Charlie van Genuchten (SURF) then presented plans for the 2026 Crisis Management Exercise, inviting input on scenario development and communication protocols to test organisational resilience.
A series of flash talks then took place, with Will Barber (GÉANT) presenting on monitoring and performance for the EuroHPC network and Jonas Hagström (SUNET) giving an overview of the network monitoring and data sharing in the Nordic countries. Giuseppe Aceto (UNINA) then introduced the Mobile App Network trAffic Nutrition fActs (MANANA) – a project from the Università degli Studi di Napoli Federico II, funded by GÉANT’s Innovation Programme. The GÉANT Innovation Programme is a unique opportunity to enable development, establish a proof of concept or testing of new ideas by offering initial funding to specific research projects carried out by the GÉANT community.
MANANA is a project that helps people understand what companies and countries their mobile apps connect to and what that means for their privacy and data rights. The tool has two main goals, to help users see how different apps use the internet so they can make smarter choices and to help researchers and regulators track how apps really behave in the real world.
The meeting ended with an open discussion led by Jonny Lundin (SUNET) about NOC on Cloud. Questions such as the following were addressed: What are the challenges of using the Cloud for the NOCs? How far have we gone for network monitoring? What happens when the Cloud does not work?
Throughout the meeting, participants engaged in discussions on best practices, tool development, and collaborative strategies to address emerging challenges in network operations. The event fostered a collaborative environment, reinforcing the importance of shared knowledge and coordinated efforts in advancing the capabilities of Network Operations Centres.
A big thank you to all those who joined both in-person and online, and a special thanks to our colleagues at CESNET who made all of this possible.
