Remote Monitoring

(RMON1)

BCN3023 Network Management 1

 Introduction
• SNMP & MIB
– These objects allowed the Management Station to
collect statistical data about devices on the agents

– The statistic data collected told little about

• the sources of received packets,
• the application protocols that initiated them or
• the content of the packets.

– They told nothing about

• the traffic on the network between the source and destination
devices.
• RMON1 – enhancement to mib and SNMP.
BCN3023 Network Management 2
 Introduction..
• RMON1 objects provide new information
at the MAC layer
• RMON2 objects provide new information
at the network layer and all layers above
• RMON devices are
– devices attached to a subnet
– Function is to read frames on that subnet and
store values of objects
• This values accessed from Management Station

BCN3023 Network Management 3

• The Remote Monitoring (RMON)
– is a tool used by network managers to
monitor remote devices.
– An RMON implementation consists of a
software agent that continually collects
statistics about a LAN and a management
station that communicates with the agent.
– The agent transfers information to the
management station on request or when a
predefined threshold is crossed.

BCN3023 Network Management 4

 RMON in LAN

• Figure 8.1

BCN3023 Network Management 5

 Mib-2 Groups

• Figure 8.2

BCN3023 Network Management 6

BCN3023 Network Management 7
BCN3023 Network Management 8
BCN3023 Network Management 9
BCN3023 Network Management 10
BCN3023 Network Management 11
• RMON1 MIB Group (mib-2.16)
• (The Object Identifier of mib-2 is
1.3.6.1.2.1)
– Statistic group (mib-2.16.1)
– History group (mib-2.16.2)
– Alarm group (mib-2.16.3)
– Host group (mib-2.16.4)
– HostTopN Group (mib-2.16.5)
– Matrix group (mib-2.16.6)
– Filter group (mib-2.16.7)
– Capture group (mib-2.16.8)
– Event group BCN3023
(mib-2.16.9)
Network Management 12
 RMON1 MIB Group - Function
• Statistic group (mib-2.16.1)
– Count packets with characteristics defined by objects
in the etherStatsTable
– The packet count is for all frames read regardless of
source
– Count the packet, octets, errors, etc, detected in
frames on the subnet
– Count numbers do not differentiate between hosts
and are totals for all hosts
– Gives a quick and broad view of how well the network
is performing to the network manager

BCN3023 Network Management 13

 RMON1 MIB Group - Function
• History group
– Enable the network manager to build a record of what is happening in
the network over time.
– Develop a history of each etherHistoryTable object
– Does this by counting packets for each object over a number of defined
sampling intervals
– The packet captured = 300 octets
– The peak num. of packets/sec = 12
– Number of bps = 300x8x12 = 28800 bps
– Utilization = bps/link speed = 28800/10Mbps
– Percentage utilization = 0.29%
– 2 tables:
• historyControlTable
– Data source, sampling intervals, number of sampling intervals
• etherHistoryTable
– How many packets were sampled in the interval time

BCN3023 Network Management 14

 RMON1 MIB Group - Function

• Host group
– Records MAC Address and statistics for packets received or
transmitted for each host detected on the subnet
– This group makes a connection between the host and the traffic
– 3 tables:
• hostControlTable
– Record the number of hosts that have transmitted or received frame in
the subnet
• hostTable
– Contain row of MAC address for each interface
• hostTimeTable
– Information stored based on time, not MAC

BCN3023 Network Management 15

 RMON1 MIB Group - Function
• HostTopN group (mib-2.16.5)
– Determines the most active N hosts during every
sampling interval for a specified variable such as “in-
packets”
– This group make it possible to calculate the rate at
which host traffic for one of the variable listed in the
hostTable is increasing or decreasing
– 1 table:
• hostTopNTable
– Identifies the data from one host
– MAC Address
– Amount of packets

BCN3023 Network Management 16

BCN3023 Network Management 17
 RMON1 MIB Group - Function
• Matrix group
– Records host MAC Addresses and statistics, such as “in-packets”,
for conversation between hosts
– This allows us to determine the source and destination of a
communication.
– Adds another dimension to network management in that we will
know which communications are causing the most traffic, not just
which hosts.
– This is done using 3 tables:
• matrixControlTable
• matrixSDTable
– Indexed by matricSDIndex, then by source address, then by destination
address
• matrixDSTable
– Indexed by matricDSIndex, then by destination address, then by source
address

BCN3023 Network Management 18

BCN3023 Network Management 19
 RMON1 MIB Group - Function
• Filter group (mib-2.16.7)
– Defines the characteristics of read packets
that should be processed by the probe.
– Such characteristics determine a channel
• Capture group
– Defines how much of a channel packet is
captured and how much is transmitted to the
Management Station

BCN3023 Network Management 20

BCN3023 Network Management 21
BCN3023 Network Management 22
 RMON1 MIB Group - Function
• Alarm group (mib-2.16.3)
– Identifies selected object values that become
greater or less than thresholds during the
sampling interval
• Event group (mib-2.16.9)
– Defines and logs events that are generated by
objects in other groups and initiates actions

BCN3023 Network Management 23

BCN3023 Network Management 24
 LAB

BCN3023 Network Management 25

Remote Monitoring
(RMON2)

BCN3023 Network Management 1

 RMON2
• RMON1 dealt primarily with the OSI data
link layer.
• RMON2 is applicable to layers 3 and
above: network to application layer.
– Good for determining bandwidth use
by applications.
• Functions are similar to RMON1.
• Enhancement to RMON1
BCN3023 Network Management 2
RMON 2 MIB

BCN3023 Network Management 3

 Protocol Directory
• Identifies the protocols that the probe can
monitor.
• Probe capability can be altered by
reconfiguring the protocolDirTable.

BCN3023 Network Management 4

 Protocol Distribution Group
• Provides information on the relative traffic
of different protocols.
• It can help the network manager manage
bandwidth based on different protocols.
• A table is kept called protocolDistStatsPkts
indexed by the protocolDistControlTable
row value and the protocolDirID.

BCN3023 Network Management 5

 nlHost & alHost Group
• nlHost helps gather statistics for nodes
whose source is not on the local network:
those nodes that are on the other side of
the router.
• alHost focuses on application traffic rather
than network traffic.

BCN3023 Network Management 6

 alMatrix Group
• Allows users to document pair wise
conversations between applications.
• It is a powerful tool for visualizing the most
heavily used conversations.

BCN3023 Network Management 7

BCN3023 Network Management 8