1. Remote Network Monitoring (RMON)
Mi-Jung Choi
Dept. of Computer Science
KNU 1 1

2. Table of Contents Basic Concepts RMON Goals RMON MIB Table Management
RMON MIB Groups
RMON2 3

3. RMON Basic Concepts
Extends the SNMP functionality without changing the protocol
Allows the monitoring of remote networks (internetwork management)
MAC-layer (layer 2 in OSI) monitoring
Defines a Remote MONitoring (RMON) MIB that supplements MIB-II
with MIB-II, the manager can obtain information on individual devices only
with RMON MIB, the manager can obtain information on the LAN as a whole
called network monitors, analyzers or probes 4

4. RMON RFCs 4

5. RMON Goals Monitoring subnetwork-wide behavior
Reducing the burden on agents and managers
Continuous off-line monitoring in the presence of failures (in network or manager)
Proactive monitoring
perform some of the manager functions (e.g., diagnostics)
Problem detection and reporting
Provide value-added (analyzed) data
Support multiple managers 4

6. Example Configuration for Remote Monitoring
Management console
with RMON probe
Ethernet
Central Site
Router
Router
Local management
console with
RMON probe
Router
Router
Ethernet
PC with
RMON probe
FDDI backbone
Bridge
Router with
RMON probe
Ethernet
Token Ring LAN
PC with
RMON probe 4

7. Example of RMON probe with two interfaces
agent a b
RMON
probe c e d
Interface 1
Interface 2
Subnetwork X Y 4

8. Control of Remote Monitors
RMON MIB contains features that support extensive control from NMS
Configuration control
Action Invocation
RMON MIB is organized into a number of functional groups
Each group may contain one or more control tables and one or more data tables
Control table (typically read-write) contains parameters that describe the data in a data table (typically read-only) 4

9. Configuration Control
At configuration time, NMS sets the appropriate control parameters to configure the remote monitor to collect the desired data
the parameters are set by adding a new row to the control table or by modifying an existing row
a control table may contain objects that specify the source of data to be collected, the type of data, the collection timing, etc.
To modify or disable a particular data collection function:
it is necessary first to invalidate the control row
this causes the deletion of that row and the deletion of all associated rows in data tables
NMS can create a new control row with the modified parameters 4

10. RMON MIB Table Mgmt (1)
The RMON specification includes a set of textual conventions and procedural rules for row addition and deletion
Textual conventions
OwnerString ::= DisplayString
EntryStatus ::= INTEGER {
valid (1),
createRequest (2),
underCreation (3),
invalid (4) } 4

11. RMON MIB Table Mgmt (2) Row Addition Row Deletion Row Modification
is achieved by using the SNMP SetRequest PDU which includes instance objects and their values
Row Deletion
is achieved by setting the status object for that row to invalid
Row Modification
is achieved by first invalidating the row and then adding the row with new object instance values 4

12. Example Control & Data Tables
rm1ControlTable
rmlControlIndex
rmlControlParameter
rmlControlOwner
rmlControlStatus 1 5
monitor
valid (1) 2 26
manager alpha
valid (1) 3 19
manager beta
valid (1)
rm1DataTable
rmlDataControlIndex
rmlDataIndex
rmlDataValue 1 1 46 2 1 96 2 2 85 2 3 77 2 4 27 2 5 92 3 1 86 3 2 26 4

13. Transitions of EntryStatus State
non-
existent
create
Request
under
Creation
valid
performed by manager
invalid
performed by agent 4

14. RMON MIB rmon (mib-2 16) statistics (1) history (2) alarm (3) host (4)
hostTopN (5)
matrix (6)
filter (7)
capture (8)
event (9)
tokenRing (10) 4

15. RMON MIB Groups
1. statistics: maintains MAC-level utilization and error stats
2. history: records periodic statistical samples from the stats group
3. alarm: allows NMS to set sampling interval & alarm threshold
4. host: contains counters for traffic from hosts on the subnetwork
5. hostTopN: contains sorted host stats that top a list based on some parameter in the host table
6. matrix: shows utilization and error stats in matrix for host pairs
7. filter: allows the monitor to observe packets that match a filter
8. capture: specifies how data is sent to NMS
9. event: specifies events to be generated by the RMON probe
10. tokenRing: maintains stats & config info for token ring subnet 4

16. RMON MIB2 RMON MIB monitors MAC-level subnet traffic
RMON MIB2 can monitor traffic of packets at layers 3 to 7 of the OSI Reference Model
Provides Network-layer Visibility
can distinguish between local LAN and remote LAN traffic
Provides Application-layer Visibility
can analyze traffic to and from hosts for particular applications
can determine which applications are putting the load on the net
RMON MIB2 is basically an extension of RMON MIB 4

17. RMON MIB2 rmon (mib-2 16) statistics (1) history (2) alarm (3)
host (4)
hostTopN (5)
matrix (6)
filter (7)
capture (8)
event (9)
tokenRing (10)
probeConfig (19)
usrHistory (18)
alMatrix (17)
alHost (16)
nlMatrix (15)
nlHost (14)
addressMap (13)
protocolDist (12)
protocolDir (11)
RMON 1
RMON 2 4

18. RMON MIB2 Groups
11. protocolDir: a master directory of all of the protocols that the probe can interpret
12. protocolDist: aggregate stats on the amount of traffic generated by each protocol, per LAN segment
13. addressMap: contains MAC and port addresses of the devices
14. nlHost: network layer traffic stats per host
15. nlMatrix: network layer traffic stats per pairs of hosts
16. alHost: application layer traffic stats per host
17. alMatrix: application layer traffic stats per pairs of hosts
18. userHistory: periodically samples and logs user-defined data
19. probeConfig: defines standard configuration parameters for RMON probes 4

19. Summary
RMON extends the SNMP functionality without changing the protocol
RMON can monitor information on a whole subnetwork
RMON is used extensively in analyzing network traffic for problem detection and network planning
RMON2 allows monitoring of traffic at layers 3 to 7 in the OSI Model
RMON2 can be used to analyze network traffic more accurately even to the application level
Read Chapters 8, 9 and 10 4