Remote Monitoring

1
Remote Monitoring
2
RMON Overview

• The RMON specification defines a set of
  statistics and functions that can be exchanged
  between RMON-compliant console managers and
  network probes
• It is an important addition to SNMP
• A standard monitoring specification that allows
  various network monitors and console systems to
  exchange network monitoring data
• RMON enables MIB information to be collected
  about network traffic
• This information are stored in a local MIB and
  transmitted to the central server until NMS
  requests the data, thus reducing network traffic
• RMON provides network administrators
• with comprehensive network fault diagnosis,
  planning, and performance tuning information.
• with more freedom in selecting network monitoring
  probes and consoles with features that meet their
  particular networking needs.

3
RMON as an extension of SNMP

• RMON is network monitoring and analysis standard
  similar to SNMP
• RMON was defined by the user community with the
  help of the Internet Engineering Task Force
  (IETF).
• became a proposed standard in 1992 as RFC 1271
  (for Ethernet).
• became a draft standard in 95 as RFC 1757,
  effectively obsoleting RFC 1271
• limitations of SNMP in traffic monitoring
• NM need to continuous retrieve MIB information
  from agents or
• agents need to continuous update NM by trap gt
  too much overhead
• RMON provide a more model to collect network
  traffics
• agent (in SNMP) gt probe (in RMON)
• a more intelligent, software process running on
  network devices to collect information and store
  it in a local MIB
• to improve efficiency of carrying of network
  traffic trends
• in SNMP gt NM need to poll devices continuous and
  calculate the trends (requires heavy traffic and
  CPU loading on NM station)
• in RMON gt probe carry out the traffic trend
  locally and only update the NM with the traffic
  trends

4
RMON-Probe

• Probes
• similar to agents in SNMP

• software processes running on network devices to
  collect information about network traffic and
  store it in a local MIB

5
RMON Groups

• RMON provides superior traffic collection and
  reporting capabilities when compared to SNMP
• If abnormal conditions are detected, the NM can
  take steps to anlayze traffic in more details
  with the help of RMON probes.
• RMON delivers information in nine RMON groups of
  monitoring elements, each providing specific sets
  of data to meet common network monitoring
  requirements
• Each group is optional so that vendors do not
  need to support all the groups within the
  Management Information Base (MIB)
• Some RMON groups require support of other RMON
  groups to function properly

6
RMON MIB (I)
7
RMON MIB (II)
8
RMON MIB (III)
9
Quiz Functions of RMON groups

• Identify the RMON groups for the following
  network traffic analysis funcitons
• If NMS want to find out which hosts are
  transmitting the most information
• ans HostTopN (gp 2)
• If NMS want to find out which host(s) are talking
  to each others
• ans Matrix groups (gp 3)

10
RMON2

• RMON2 (RFC 2021) expands on the features of the
  original RMON
• RMON2 drives remote monitoring standards beyond
  the Media Access Control (MAC) layer to the
  network and application layers.
• This setup enables administrators to analyse and
  troubleshoot on individual networked applications
  such as Web traffic, e-mail, database access,
  Network File System (NFS) and others.
• provides information about the actual usage of
  the network,
• provide information about end-to-end traffic flows

11
RMON2 (II)

• The nine RMON2 functions are
• Protocol Directory
• Protocol Distribution
• Network Layer Host
• Network Layer Matrix
• Application Layer Host
• Application Layer Matrix
• User-definable History
• Address Mapping
• Configuration Group

12
Summary

• Functions of RMON
• Extension to allow specific network traffic
  information to be located and transmitted to NMS
  when needed
• 9 function group of RMON
• Statistics collects and accumulates traffic
  statistics
• History collect statistics at defined intervals
• alarmalerts when predefined thresholds are
  exceeds
• Host collect information and statistics at MAC
  level
• HostTopN collect which hosts transmitting most
• Matrix collect information about devices
• Events trigger action based on alarms
• Packet Capture provide a way to capture selected
  type of packet
• Filter provide a way to view selected type of
  packets