1. Remote Monitoring and Desktop Management Week-7

2. SNMP designed for management of a limited range of devices and a limited range of functions Monitoring is difficult in both WANs and the newer switched LANs. Remote Monitoring and Desktop Management

3. SNMP network management tools can support the monitoring of individual devices. However, it is difficult to learn about traffic on a particular network using SNMP. Remote Monitoring

4. Protocol analysers can support viewing of each packet that passes on a network. In a network using routing or switches, monitors will only see the traffic on their part of the network. Thus, the devices cannot cover whole network. Protocol Analysers as Monitors

5. Could have one monitor per subnetwork or switched section - may be excessively costly if use protocol analysers. If dedicated monitoring modules are used that report back to a network management station, this may be possible. This is called remote monitoring. Remote Network Monitors

6. A range of standard functions have been defined for remote monitoring within SNMP - RMON. RMON agents may be dedicated hardware devices attached to a subnetwork or may be software running in networked devices (computers, switches, routers, printers, etc) Remote Monitor - RMON

7. Off-line operation Monitor collects statistics (packet counts, error rates, etc) with management station retrieving data after some time duration. Reduces network traffic. RMON normally supports:

8. Preemptive Monitoring Monitor runs diagnostics and collects statistics continuously, reporting failure to management station and supplying diagnostic information to assist problem resolution. RMON normally supports:

9. Problem detection and reporting Monitor passively observes its subnetwork and reports to management station on specific problems that are observed. RMON normally supports:

10. Value-added data Monitor can provide information of greater detail and with analysis that would normally only be available to an analyser attached to that subnetwork - eg, hosts generating most traffic. RMON normally supports:

11. Multiple managers Monitors may be expected to provide support for more than one management station. RMON normally supports:

12. A monitor is required to perform tasks that are more sophisticated than the devices normally managed using SNMP (routers, bridges, etc). Thus it must be able to interact with a management station to provide data and receive commands of some complexity. Monitor Control

13. SNMP was not originally intended for this and so needs some minor changes to support RMON. This is done via an RMON MIB. Monitor Control

14. RMON Overview  A standard MIB  Described in RFC 1757  Defines MAC-layer statistics and control objects  Monitors basic Ethernet operations  Powerful alarm and event mechanism  Automatic historical data collection –Utilisation –Collisions –Usage patterns –Planning data

15. RMON Architecture WAN LAN segments Router RMON DCM

16. Statistics - utilisation and error rates history - periodic samples are stored alarm - alarm thresholds can be set host - traffic to/from hosts on subnetwork hostTopN - maintains a list of highest recorded (peak) statistics for hosts matrix - error and utilisation data can be returned as a matrix for all addresses of nodes recorded RMON Group objects

17. filter - permits the setup of selective monitoring packet capture - determines how the monitor delivers data to the management station event - table of all events generated by the RMON agent RMON Group objects

18. RMON agents may be set to retain information for a period of time, or to return data immediately. In either case, the volume of data may reduce network performance. However, the trade-off may be the lack of network knowledge…. Network Overload

19. The volume or detail of information required to be accessed by RMON agents may be so great that it may affect monitoring device performance. In high-volume situations (high speed switches, etc) dedicated devices are preferable. Monitoring Device Overload

20. Desktop Management Task Force a collection of computer industry parties (Microsoft, Intel, etc see www.dmtf.org ) have been working on the development of an agent that can reside in device to be managed. www.dmtf.org Desktop Management

21. The DMTF developed the Desktop Management Interface (DMI) a standardised system to carry out the task. Resides as a TSR (Terminate and Stay Resident program) or as a windows DLL. DTMF - DMI

22. Desktop management Interface

23. Initial development of the user agent has centred around the IBM- compatible PC-style machines. However, there is intended to be a standard interface for all operating environments and platforms.

24. A remote management station can then provide a wide range of supportive functions from "over-the-shoulder" helping of the user, to taking over of the keyboard and "becoming the user" to run through a sequence of operations.

25. The management station can also provide many remote management functions like backup and automatic software upgrades, independent of the users involvement. The management agent will be a standardised product that is compatible with the current and future management standards (CMIP, SNMP).

26. Desktop management using a local agent offers many advantages, particularly in the areas of system security and reliability and it may be necessary for the support of network administration in the new networking environments.