network protocols handbook.pdf

33Protocols GuideTCP/IP - Application Layer ProtocolsProtocol NameRMON: Remote MonitoringMIBs (RMON1 and RMON2)Protocol DescriptionRemote Monitoring (RMON) is a standard monitoring specificationthat enables various network monitors and console systemsto exchange network-monitoring data. RMON provides networkadministrators with more freedom in selecting network-monitoringprobes and consoles with features that meet their particularnetworking needs.RMON was originally developed to address the problem of managingLAN segments and remote sites from a central location.The RMON is an extension of the SNMP MIB. Within an RMONnetwork monitoring data is defined by a set of statistics andfunctions and exchanged between various different monitorsand console systems. Resultant data is used to monitor networkutilization for network planning and performance-tuning, as wellas assisting in network fault diagnosis.There are 2 versions of RMON: RMONv1 and RMONv2.RMONv1, which can now be found on most modern networkhardware, defined 9 MIB groups for basic network monitoring.RMON2 is an extension of RMON that focuses on higherlayers of traffic above the medium access-control(MAC) layer.RMON2 has an emphasis on IP traffic and application-level traffic.RMON2 allows network management applications to monitorpackets on all network layers. This is different from RMONv1,which only allows network monitoring at MAC layer or below.RMON solutions are comprised of two components: a probe (oran agent or a monitor), and a management station. Agents storenetwork information within their RMON MIB and are normallyfound as embedded software on network hardware such asrouters and switches although they can be a program runningon a PC. Agents can only see the traffic that flows through themso they must be placed on each LAN segment or WAN link thatis to be monitored. Clients, or management stations, communicatewith the RMON agent or probe, using SNMP to obtain andcorrelate RMON data.There are a number of variations to the RMON MIB. For example,the Token Ring RMON MIB provides objects specificto managing Token Ring networks. The SMON MIB extendsRMON by providing RMON analysis for switched networks.Protocol StructureThe monitoring focus of RMON1 and RMON 2 in the networklayers:Figure 2-1: RMON Monitoring LayersRMON 1MIB GroupStatisticsHistoryAlarmHostHostTopNMatrixFiltersPacketCaptureEventsToken RingOSI Model7. Application Layer6. Presentation Layer5. Session Layer4. Transport Layer3. Network Layer2. MAC Layer (DLC)1. Physical LayerFunctionContains statisticsmeasured by theprobe for each monitoredinterface on thisdevice.Records periodic statisticalsamples froma network and storesfor retrieval.Periodically takesstatistical samplesand compares themwith set thresholds forevents generation.Contains statisticsassociated with eachhost discovered onthe network.Prepares tables thatdescribe the tophosts.Stores and retrievesstatistics for conversationsbetween setsof two addresses.Enables packets tobe matched by a filterequation for capturingor events.Enables packets tobe captured afterthey flow through achannel.Controls the generationand notificationof events from thisdevice.Support of TokenRingElementsPackets dropped, packets sent,bytes sent (octets), broadcastpackets, multicast packets,CRC errors, runts, giants, fragments,jabbers, collisions, andcounters for packets rangingfrom 64 to 128, 128 to 256, 256to 512, 512 to 1024, and 1024to 1518 bytes.Sample period, number ofsamples, items sampled.Includes the alarm table andrequires the implementation ofthe event group. Alarm type,interval, starting threshold, stopthreshold.Host address, packets, bytesreceived and transmitted, aswell as broadcast, multicast,and error packets.Statistics, host(s), sample startand stop periods, rate base,duration.Source and destination addresspairs and packets, bytes, anderrors for each pair.Bit-filter type (mask or notmask), filter expression (bitlevel), conditional expression(and, or not) to other filters.Size of buffer for captured packets,full status (alarm), numberof captured packets.Event type, description, lasttime event sent(not used often)Monitored byRMON 2RMON 1