RMON: Remote Monitoring MIBs in SNMP

Remote Monitoring (RMON) is a standard monitoring specification that enables various network monitors and console systems to exchange network-monitoring data. RMON provides network administrators with more freedom in selecting network-monitoring probes and consoles with features that meet their particular networking needs. RMON was originally developed to address the problem of managing LAN segments and remote sites from a central location. The RMON specification is an extension of the SNMP MIB. Within an RMON, network monitoring data is defined by a set of statistics and functions and exchanged between various different monitors and console systems. Resultant data is used to monitor network utilization for network planning and performance tuning, as well as assisting in network fault diagnosis. There are 2 versions of RMON: RMONv1 and RMONv2. RMONv1, which can now be found on most modern network hardware, defined 9 MIB groups for basic network monitoring.. RMON2 is an extension of RMON that focuses on higher layers of traffic above the medium access control (MAC) layer. RMON2 has an emphasis on IP traffic and application level traffic. RMON2 allows network management applications to monitor packets on all network layers. This is different from RMONv1, which only allows network monitoring at MAC layer or below. RMON solutions are comprised of two components: a probe (or an agent or a monitor), and a management station. Agents store network information within their RMON MIB and are normally found as embedded software on network hardware such as routers and switches although they can be a program running on a PC. Agents can only see the traffic that flows through them so they must be placed on each LAN segment or WAN link that is to be monitored. Clients, or management stations, communicate with the RMON agent or probe, using SNMP to obtain and correlate RMON data. Now, there are a number of variations to the RMON MIB. For example, the Token Ring RMON MIB provides objects specific to managing Token Ring networks. The SMON MIB extends RMON by providing RMON analysis for switched networks. Protocol Structure The RMON1 and RMON2 are focused at different network layers:

The RMON1 and RMON2 are focused at different network layers RMON 1 Function MIB Group Contains statistics measured by the probe for each monitored interface on this device. Elements Packets dropped, packets sent, bytes sent (octets), broadcast packets, multicast packets, CRC errors, runts, giants, fragments, jabbers, collisions, and counters for packets ranging from 64 to 128, 128 to 256, 256 to 512, 512 to 1024, and 1024 to 1518 bytes.

Statistics

History

Records periodic statistical samples from a network Sample period, number of samples, items sampled. and stores for retrieval. Periodically takes statistical samples and compares them with set thresholds for events generation. Includes the alarm table and requires the implementation of the event group. Alarm type, interval, starting threshold, stop threshold.`

Alarm

Host

Contains statistics Host address, packets, and bytes received and associated with each host transmitted, as well as broadcast, multicast, and error discovered on the network. packets. Prepares tables that describe the top hosts. Stores and retrieves statistics for conversations between sets of two addresses. Enables packets to be matched by a filter equation for capturing or events. Statistics, host(s), sample start and stop periods, rate base, duration. Source and destination address pairs and packets, bytes, and errors for each pair.

HostTopN

Matrix

Filters

Bit-filter type (mask or not mask), filter expression (bit level), conditional expression (and, or not) to other filters.

Packet Capture

Enables packets to be captured after they flow through a channel. Controls the generation and notification of events from this device. Support of Token Ring

Size of buffer for captured packets, full status (alarm), number of captured packets.

Events Token Ring

Event type, description, last time event sent (not used often)

RMON 2 MIB Group Protocol Directory Protocol Distribution Address mapping Network Layer host Network layer matrix Application layer host Application layer matrix User history Probe configuration

Functions The Protocol Directory is a simple and interoperable way for an RMON2 application to establish which protocols a particular RMON2 agent implements. This is especially important when the application and the agent are from different vendors Mapping the data collected by a probe to the correct protocol name that can then be displayed to the network manager. Address translation between MAC-layer addresses and network-layer addresses which are much easier to read and remember. Address translation not only helps the network manager, it supports the SNMP management platform and will lead to improved topology maps. Network host (IP layer) statistics Stores and retrieves network layer (IP layer) statistics for conversations between sets of two addresses. Application host statistic Stores and retrieves application layer statistics for conversations between sets of two addresses. This feature enables the network manager to configure history studies of any counter in the system, such as a specific history on a particular file server or a router-to-router connection This RMON2, feature enable one vendor"s RMON application to remotely configure another vendor"s RMON probe.

Related Terms: SNMP, SNMPv1, SNMPv2, SNMPv3, SMI

Sponsor Source: RMON is defined by IETF (http://www.ietf.org) through a group of RFCs shown in the reference