Remote Network Monitoring MIB Version 2

1
Remote Network Monitoring MIB Version 2
2
RMON2 (RFC 2021)

• Layer 3 7 monitoring
• Network-layer visibility -- Monitor traffic on
  the basis of network-layer protocols and
  addresses
• Application-level visibility --Monitor traffic to
  and from hosts for particular applications, e.g.
  e-mail, file transfer, WWW

3
RMON2

• With network-layer visibility, the network
  manager can answer a number of new questions
• If there is excessive load on the LAN due to
  incoming router traffic,
• what networks or hosts account for the bulk of
  that incoming traffic?
• If a router is overloaded because of high amounts
  of outgoing traffic,
• what local hosts account for the bulk of that
  outgoing traffic, and
• to what destination networks or hosts is that
  traffic directed?
• If there is a high load of pass-through traffic,
• what networks or hosts are responsible for the
  bulk of this traffic?

4
RMON2

• With application-level visibility, a network
  management application can
• charts and graphs showing traffic percentage by
  protocols or by applications

5
RMON2 MIB
6

• protocol directory (protocolDir) a master
  directory of all of the protocols
  that the probe can interpret
• protocol distribution (protocolDist) aggregate
  statistics on the amount of traffic generated
  by each protocol, per LAN segment
• address map (addressMap) matches each network
  address to a specific MAC address and port on
  an attached device and the physical address on
  this subnetwork
• network-layer host (nlHost) statistics on the
  amount of traffic into and out of hosts on the
  basis of the network-layer address
• application-layer host (alHost) statistics on
  the amount of traffic into and out of hosts on
  the basis of application-level address
• application-layer matrix (alMatrix) statistics
  on the amount of traffic between pairs of hosts
  on the basis of application-level address
• user history collection (usrHistory)
  periodically samples user-specified variables
  and logs that data based on user-defined
  parameters
• probe configuration (probeConfig) defines
  standard configuration parameters for RMON
  probes

7
New Features not Found in RMON1

• Indexing with external objects it is possible
  to use an object that is not part of the a
  conceptual table as an index for that table
• Time filter indexing to enable a manager to
  download from a probes table only those rows
  that have changed since a specified time

8
Indexing with External Objects (example)
rm2DataTable OBJECT-TYPE SYNTAX SEQUENCE OF
Rm2CtrlEntry ex1 2 rm2DataEntry
OBJECT-TYPE SYNTAX Rm2DataEntry INDEX
rm2ControlIndex, rm2DataIndex
rm2DataTable 1 Rm2DataEntry SEQUENCE
rm2DataIndex INTEGER, rm2DataValue
Counter

• rm2ControlTable OBJECT-TYPE
• SYNTAX SEQUENCE OF Rm2ControlEntry
• ex1 1
• rm2ControlEntry OBJECT-TYPE
• SYNTAX Rm2ControlEntry
• INDEX rm2ControlIndex
• rm2ControlTable 1
• Rm2ControlEntry SEQUENCE
• rm2ControlIndex INTEGER,
• rm2ControlParameter Counter,
• rm2ControlOwner OwnerString,
• rm2ControlStatus RowStatus

The index rm2ControlIndex is not an object in
the rmDataTable.
9
Time Filter Indexing

• A new textual convention
• TimeFilter TEXTUAL-CONVENTION
• STATUS CURRENT
• DESCRIPTION
• .
• SYNTAX TimeTicks
• Use an object of syntax TimeFilter as an index of
  a table
• To enable a manager to download from a probes
  table only those rows that have changed since a
  specified time

10
Time Filter Indexing (example)

• fooTable OBJECT-TYPE
• SYNTAX SEQUENCE OF FooEntry
• ACCESS not-accessible
• STATUS current
• DESCRIPTION
• "A control table."
• ex 1

fooEntry OBJECT-TYPE SYNTAX FooEntry ACCESS
not-accessible STATUS current DESCRIPTION
"One row in fooTable. " INDEX fooTimeMark,
fooIndex fooTable 1 FooEntry
SEQUENCE fooTimeMark TimeFilter, fooIndex
INTEGER, fooCounts Counters32
11
Time Filter Indexing (example)

• When an agent receives a request for a
  time-filtered access to a particular conceptual
  row, the agent filters the actual table as
  follows
• if (timestamp-for-this-fooIndexgt
  TimeFilter-value-in-Request)
• / return this instance in a response
  PDU /
• else / skip this instance /

12
Protocol Directory Group

• A master directory of all of the protocols that
  the probe can interpret

13
Protocol Identifier protoclDirID

• The ptotocolDirID object contains a unique octet
  string for a specific protocol
• Octet string identifiers for protocols are
  arranged in a tree structured hierarchy, similar
  to the hierarchy of MIB objects
• Each protocol layer is identified by one or more
  32-bit values
• Each 32-bit value is encoded as four
  subidentifiers, a.b.c.d
• Each subidentifier is one octet long
• For example, the layer identifier for Ethernet is
  0.0.0.1 and is referred to symbolically as
  ether2

14
Protocol Identifier protoclDirID (continued)

• The first level of octet string identifiers is
  for MAC protocols
• Five identifiers have been assigned so far
• ether2 0.0.0.1
• llc 0.0.0.2
• snap 0.0.0.3
• vsnap 0.0.0.4
• ianaAssigned 0.0.0.5
• Under each of these nodes in the identifier tree
  are protocols that are directly encapsulated by
  that MAC-protocol

15
Protocol Identifier protoclDirID (continued)

• Format for index values for ProtocolDirTable

cnt count the number of octets in the remainder
of the field
16
Protocol Identifier protoclDirID (continued)

• Example protocolDirID for ether2.ip.udp.snmp
• 16.0.0.0.1.0.0.8.0.0.0.0.17.0.0.0.161
• A separate entry is needed for each protocol that
  the probe can interpret and count
• Four entries are needed for ether2.ip.udp.snmp in
  ProtocolDirEntry
• ether2 (4.0.0.0.1)
• ?ether2.ip (8.0.0.0.1.0.0.8.0)
• ?ether2.ip.udp. (12.0.0.0.1.0.0.8.0.0.0.0.17)
• ?ether2.ip.udp.snmp (16.0.0.0.1.0.0.8.0.0.0.0.17.0
  .0.0.161)

17
Protocol Parameters protoclDirParameters

• This object instance indicates the probes
  capability with respect to a particular protocol

18
protoclDirParameters (continued)

• The following common bit definitions are reserved
  and used by different protocols
• countsFragments (bit 0) higher-layer protocols
  encapsulated within this protocol will be counted
  correctly even if this protocol fragments the
  upper layers into multiple packets
• tracksSessions (bit 1) correctly attributes all
  packets of a protocol which starts sessions on
  well known ports or sockets and then transfers
  them to dynamically assigned ports or sockets
  thereafter (e.g. TFTP)
• Example
• 16.0.0.0.1.0.0.8.0.0.0.0.17.0.0.0.161.4.0.1.0.0
• ether2.ip.udp.snmp with fragments counted
  correctly for IP and above

19
Other Objects in protocolDirTable

• protocolDirLocalIndex Integer32
• An arbitrary unique index number associated with
  this entry
• This index is a convenient way to refer to a
  specific entry and is used in the other RMON
  groups
• protocolDirType BITS (two bits)
• extensible (bit 0) whether the agent or manager
  may extend this table by creating entries that
  are children of this protocol
• addressRecognitionCapable (bit 1) whether the
  probe can recognize source and destination
  address fields

20
Other Objects in protocolDirTable (continued)

• protocolDirAddressMapConfig INTEGER
• notSupported(l) does not support address
  mapping
• supportedOff(2) support address mapping, but
  is configured not to perform address mapping
• supportedOn(3) support address mapping, and is
  configured to perform address mapping
• protocolDirHostConfig may be set to
  notSupported(l), supportedOff(2), or
  supported0n(3) with respect to the network-layer
  and application-layer host table for this
  protocol
• protocolDirMatrixConfig may be set to
  notSupported(l), supportedOff(2), or
  supported0n(3) with respect to the network-layer
  and application-layer matrix tables for this
  protocol

21
Protocol Distribution Group protocolDist

• Summarizes how many octets and packets have been
  sent from each of the protocols supported

22
protocolDistControlTable

• Each row in protocolDistControlTable refers to a
  unique network interface for this probe and
  controls a number of rows of protocolDistStatsTabl
  e
• protocolDistControlIndex an integer that
  uniquely identifies a row in the
  protocolDistControlTable (The same integer is
  also used to index corresponding rows in
  protocolDistStatsTable.)
• protocolDistControlDatasource identifies the
  interface and hence the sub-network that is the
  source of the data for this row
• protocolDistControlDroppedFrames total number
  of received frames for this interface that the
  probe chose not to count (Typically, a frame is
  not counted when the probe is out of some
  resources and decides to shed load from this
  collection.)
• protocolDistControlCreateTime the value of
  sysUpTime when this control entry was activated

23
protocolDistStatsTable

• Includes one row for each protocol in
  protocolDirTable for which at least one packet
  has been seen
• protocolDistStatsPkts the number of packets
  without errors received of this protocol type
• protocolDistStatsOctets the number of octets
  received of this protocol type since it was added
  to the protocolDistStatsTable, except for those
  octets in packets that contained errors.

24
Address Map Group addressMap

• Lists MAC address to network address bindings
  discovered by the probe and what interface they
  were last seen on
• Helpful in node and network topology discovery
• Consists of three scalar objects, a control table
  and a data table

25
Address Map Group addressMap
26
The three scalar objects

• addressMapInserts the number of times an
  address-mapping entry has been inserted into the
  data table
• addressMapDeletes the number of times an
  address-mapping entry has been deleted from the
  data table
• addressMapMaxDesiredEntries the desired maximum
  number of entries in addressMapTable (If this
  value is set to -1, the probe may create any
  number of entries in addressMapTable.)
• The current size of the data table is easily
  calculated
• data table size addressMapInserts -
  addressMapDeletes

27
addressMapControlTable

• addressMapControlIndex a unique index for this
  entry in the addressMapControlTable
• addressMapControlDataSource identifies the
  interface thst is the source of the data for this
  row
• addressMapControlDroppedFrames total number of
  frames for this interface that the probe chose
  not to count (Typically, this event occurs when
  the probe is out of some resources and decides to
  shed load by not collecting statistics.)

28
addressMapTable

• The probe will add entries to this table based on
  the source MAC and network addresses seen in
  packets without MAC-level errors
• The table will create entries for all protocols
  in the protocol directory table whose value of
  protocolDirAddressMapConfig is equal to
  supportedOn(3)
• This table can be used to detect duplicate IP
  addresses

29
addressMapTable (continued)

• addressMapTimeMark a time filter for this entry
  
• addressMapNetworkAddress the source network
  address for this entry
• addressMapSource the last interface or repeater
  port on which the associated network address was
  seen
• addressMapPhysicalAddress the last source MAC
  address on which the associated network address
  was seen
• addressMapLastChange the value of sysUpTime at
  the time this entry was most recently updated

30
Host Groups

• Two host groups deal with the collection of
  statistics on a host basis
• Network layer host group statistics based on
  network-layer address
• Application-layer host group statistics based
  on application-level protocol
• Both groups contains a data table that is
  controlled by a control table in the
  network-layer host group

31
Network Layer Host Group
32
nlHostControlTable
33
nlHostControlTable

• nlHostControlIndex an integer that uniquely
  identifies a row in the nlHostControlTable. (The
  same integer is also used to identify
  corresponding rows in the nlHostTable and the
  alHostTable.)
• nlHostControlDatasource identifies the
  interface, and hence the subnetwork, that is the
  source of the data for the data table entries
  defined by this row
• nlHostControlNlDroppedFrames total number of
  received frames for this interface that the probe
  chose not to count for the associated nlHost
  entries
• nlHostControlNHnserts the number of times an
  nlHost entry has been inserted into the
  nlHostTable data table
• nlHostControlNlDeletes the number of times an
  nlHost entry has been deleted from the
  nlHostTable
• nlHostControlNlMaxDesiredEntries the desired
  maximum number of entries in nlHostTable

34
nlHostControlTable (continued)

• nlHostControlAlDroppedFrames total number of
  received frames for this interface that the probe
  chose not to count for the associated alHost
  entries
• nlHostControlAlInserts the number of times an
  alHost entry has been inserted into the
  alHostTable data table
• nlHostControlAlDeletes the number of times an
  alHost entry has been deleted from the
  alHostTable
• nlHostControlAlMaxDesiredEntries the desired
  maximum number of entries in alHostTable

35
nlHostTable
36
nlHostTable

• nlHostTimeMark a time filter for this entry
• nlHostAddress the network address for this
  entry
• nlHostInPackets the number of error-free
  packets transmitted to this address since it was
  added to the table
• nlHostOutPackets the number of error-free
  packets that were transmitted from this address
  since it was added to the table
• nlHostInOctets the number of octets transmitted
  to this address since it was added to the table,
  not counting octets in packets containing errors
• nlHostOutOctets the number of octets
  transmitted by this address since it was added to
  the table, not counting octets in packets
  containing errors
• nlHostCreateTime the value of sysUpTime when
  this control entry was activated
• nlHostOutMacNonUnicastPkts the number of
  packets transmitted by this address that were
  directed to the MAC broadcast address or to any
  MAC multicast address since this entry was added
  to the table

37
Application-Layer Host Group alHost

• There is one entry in alHostTable for each
  application-level protocol discovered at each
  known network-layer address
• The term"application level" refers to all
  protocols above the network layer
• The alHostTable will create entries for all
  application-level protocols in the protocol
  directory table whose value of protocolDirAlHostCo
  nfig is equal to supportedOn (3)
• The probe adds entries to this table for all
  addresses seen as the source or destination
  address in all packets with no MAC errors

38
Application-Layer Host Group alHost
39
alHostTable

• alHostTimeMark a time filter for this entry
• alHostInPackets the number of error-free
  packets of this protocol type transmitted to this
  address since it was added to the table
• alHostOutPackets the number of error-free
  packets of this protocol type that were
  transmitted from this address since it was added
  to the table
• alHostInOctets the number of octets of this
  protocol type transmitted to this address since
  it was added to the table, not counting octets in
  packets containing errors
• alHostOutOctets the number of octets of this
  protocol type transmitted by this address since
  it was added to the table, not counting octets in
  packets containing errors
• alHostCreateTime the value of sysUpTime when
  this control entry was activated

40
alHostTable Index

• The alHostTable is indexed by five objects
• nIHostControlIndex defines the interface
• alHostTimeMark a time filter
• protocolDirLocalIndex the identity of the
  network-layer protocol
• nIHostAddress the network address
• protocolDirLocalIndex the application-level
  protocol
• The object protocolDirLocalIndex is used twice to
  index the table.
• Two distinct object instances are used for the
  two indexes one for a network-layer protocol and
  one for an application-level protocol

41
Matrix Groups

• Two matrix groups deal with the collection of
  statistics of pairs of hosts
• Network-layer matrix group (nlMatrix)
• nlMatrixControlTable, nlMatrixSDTable,
  nlMatrixDSTable
• nlMatrixTopNControlTable, nlMatrixTopNTable
• Application-layer matrix group (alMatrix)
• alMatrixSDTable, alMatrixDSTable
• (controlled by nlMatrixControlTable)
• alMatrixTopNControlTable, alMatrixTopNTable

42
nlMatrix
43
nlMatrixControlTable
44
nlMatrixSDTable
45
nlMatrixDSTable
46
Network-Layer TopN Statistics

• The philosophy differs from that of RMON1
• The ranking is of the traffic between pairs of
  hosts based on some parameter
• (In RMON1, the ranking is the traffic of hosts
  on one subnetwork based on some parameter)

47
TopN Tables
48
nlMatrixTopNControlTable
49
nlMatrixTopNControlTable (continued)

• nlMatrixTopNControlIndex an integer that
  uniquely identifies a row in the
  nlMatrixTopNControlTable (Each row in the control
  table defines one topN report prepared for one
  interface.)
• nlMatrixTopNMatrixIndex specifies a particular
  subnetwork, since this value matches a value of
  nlMatrixControlIndex (The topN report defined by
  this row of the control table is prepared using
  the corresponding entries in nlMatrixSDTable or
  nlMatrixDSTable.)
• nlMatrixTopNRateBase specifies one of two
  variables in nIMatrixTopNTable that is to be used
  to sort the table the type of this object is the
  following
• INTEGER nlMatrixTopNPkts(1),
  nlMatrixTopNOctets(2)

50
nlMatrixTopNControlTable (continued)

• nlMatrixTopNTimeRemaining the number of seconds
  left in the sampling interval for the report
  currently being collected
• nlMatrixTopNGeneratedReports the number of
  reports that have been generated by this entry
• nMatrixTopNDuration the sampling interval, in
  seconds, for this report
• nlMatrixTopNRequestedSize the maximum number of
  matrix entries requested for the topN table
• nlMatrixTopNGrantedSize the maximum number of
  entries in the topN table
• nlMatrixTopNStartTime the value of sysUpTime
  when this topN report was last started (In other
  words, this is the time when the associated
  hostTopNTimeRemaining object was modified to
  start the requested report.)

51
nlMatrixTopNTable
52
nlMatrixTopNTable (continued)

• nlMatrixTopNIndex an index that uniquely
  identifies one row among all data rows associated
  with a particular report (Each row represents a
  unique source-destination pair of hosts.)
• nlMatrixTopNProtocolDirLocalIndex the
  protopcolDirLocalIndex value that uniquely
  identifies a particular network-layer protocol
• nlMatrixTopNSourceAddress the network-layer
  address of the source host in this pairing
• nlMatrixTopNInDestAddress the network-layer
  address of the destination host in this pairing

53
nlMatrixTopNTable (continued)

• nlMatrixTopNPktRate the number of packets seen
  from the source host to the destination host
  during this sampling interval
• nlMatrixTopNReversePktRate the number of
  packets seen from the destination host to the
  source host during this sampling interval
• nlMatrixTopNOctetRate the number of octets seen
  from the source host to the destination host
  during this sampling interval
• nIMatrixTopNReverseOctetRate the number of
  octets seen from the destination host to the
  source host during this sampling interval

54
TopN Report Preparation Process

• A management station creates a row of the control
  table to specify a new report
• This control entry instructs the monitor to
  measure the difference between the beginning and
  ending values of a particular matrix group
  variable over a specified sampling period
• When nlMatrixTopNTimeRemaining reaches 0, the
  monitor calculates the final results and creates
  a set of N data rows, indexed by
  nlMatrixTopNIndex, with the top N pairs of hosts
  listed in decreasing order of the calculated rates

55
TopN Report Preparation Process (continued)

• Unlike RMON1, RMON2 TopN tables automatically
  retrigger when the sort completes. In this way,
  the sorted report is updated every TopNDuration
  seconds automatically
• Once the report is created, it remains as a set
  of read-only data rows available to the
  management station until it is overwritten by a
  new report
• A network management system can determine whether
  a new report is available yet by polling the
  TopNGeneratedReports object
• The network management system must retrieve a new
  report withinTopNDuration or else lose it

56
Application-Layer Matrix Group
57
Application-Layer Source/Destination Statistics
58
alMatrixSDTable

• alMatrixSDTimeMark a time filter for this entry
  
• alMatrixSDPackets the number of error-free
  packets transmitted from this source address to
  this destination address
• alMatrixSDOctets the number of octets,
  excluding packets with errors, transmitted from
  this source address to this destination address
• alMatrixSDCreatelime the value of sysUpTime
  when this control entry was activated

59
Indexes for alMatrixSDTable

• nlMatrixControlIndex identifies a unique
  subnetwork and a unique row of nlMatrixControlTabl
  e. This selects all of the rows of
  alMatrixSDTable controlled by this row.
• alMatrixSDTimeMark a time filter index.
• protocolDirLocalIndex identifies a unique
  network-layer protocol.
• nlMatrixSDSourceAddress identifies the unique
  source address on this subnetwork with this
  network-layer protocol.
• nlMatrixSDDestAddress identifies the unique
  destination address on this subnetwork with this
  network-layer protocol.
• protocolDirLocalIndex identifies a unique
  application-level protocol that runs on the
  selected network-layer protocol.

60
Application-Layer TopN Statistics
61
alMatrixTopNControlTable
62
alMatrixTopNTable
63
User History Collection Group (usrHistory)
64
User History Collection Group (usrHistory)

• Periodically polls particular statistics and
  variables and then logs that data based on
  user-defined parameters
• The structure of this group is the most complex
  of all of the RMON groups.
• This group consists of a three-level hierarchy of
  tables

65
Three-level Hierarchy of Tables

• Top level usrHistoryControlTable
• Specified the details of the sampling function
• 2nd level usrHistoryObjectTable
• Specifie the variables to be sampled
• 3rd level usrHistoryTable
• Records the specified data

66
Three-level hierarchy of tables
67
usrHistoryControlTable
68
usrHistoryControlTable

• usrHistoryControlIndex an integer that uniquely
  identifies a row in the usrHistoryControlTable
• usrHistoryControlObjects This is the number of
  mib objects for which data are to be collected in
  the portion of usrHistoryTable associated with
  this entry
• usrHistoryControlBucketsRequested the requested
  number of discrete sampling intervals over which
  data are to be saved in the part of
  usrHistoryTable associated with this entry. The
  default value is 50.
• usrHistoryControlBucketsGranted the actual
  number of discrete sampling intervals over which
  data will be saved in the part of usrHistoryTable
  associated with this entry
• usrHistoryControlInterval the interval (from 1
  to 231 - 1 seconds (over 68 years!) ) over which
  data are sampled for each bucket in the part of
  usrHistoryTable associated with this entry. The
  default value is 1800 seconds (30 minutes)

69
usrHistoryObjectTable
70
usrHistoryObjectTable

• usrHistoryObjectIndex an integer that uniquely
  identifies a row in the usrHistoryObjectTable.
  Each entry defines a mib object instance to be
  sampled periodically.
• usrHistoryObjectVariable The value of this
  object is an object identifier that specifies the
  particular mib object instance to be sampled.
• usrHistoryObjectSampleType takes on the value
  absoluteValue(l) or deltaValue (2)

71
usrHistoryTable
72
usrHistoryTable

• usrHistorySampleIndex an index that uniquely
  identifies the particular sample this entry
  represents among all samples associated with the
  same row of the usrHistoryControlTable. This
  index starts at 1 and increases by one as each
  new sample is taken.
• usrHistoryIntervalStart This gives the value of
  sysUpTime at the start of the interval over which
  this sample was measured.
• usrHistoryIntervalEnd This indicates the value
  of sysUpTime at the end of the interval over
  which this sample was measured.
• usrHistoryAbsValue the absolute value of the
  user specified statistic during the last sampling
  period. This object has a syntax of Gauge32 and
  therefore ranges from 0 to 232-1
• usrHistoryValStatus takes on the values
  valueNotAvailable(l), valuePositive (2),
  valueNegative(3).

73
Probe Configuration Group (probeConfig)

• The probe configuration (probeConfig) group is
  designed to enhance interoperability among RMON
  probes and managers by defining a standard set of
  configuration parameters for probes
• This makes it easier for one vendor's RMON
  application to be able to configure remotely
  another vendor's RMON probe.
• The probe configuration group consists of a set
  of scalar objects plus four tables

74
Probe Configuration Group (probeConfig)
75
The scalar objects

• probeCapabilities indicates which RMON groups
  are supported
• probeSoftwareRev software revision of this
  device
• probeHardwareRev hardware revision of this
  device
• probeDateTime probe's current date and time
• probeResetControl takes on the values running
  (1), warmBoot (2), and coldBoot(3)
• probeDownloadFile the name of the file that
  contains the boot image to be downloaded from the
  TFTP (Trivial File Transfer Protocol) server
• probeDownloadTFTPServer the IP address of the
  TFTP server that contains the boot image to load

76
The scalar objects (continued)

• probeDownloadAction takes on the values
  notDownloading(1), downloadToPROM(2), and
  downloadToRAM(3) (When this object is set to (2)
  or (3), the device discontinues normal operation,
  downloads the boot image, and then does a warm
  boot to restart the newly loaded application.)
• probeOutDownloadStatus defined as follows
• INTEGER downloadSuccess(1),
• 
  downloadStatusUnknown(2),
• 
  downloadGeneralError(3),
• 
  dcwnloadNoResponseFromServer(4),
• 
  downloadChecksumError(5),
• 
  downloadlncompatiblelmage(6),
• 
  tftpFileNotFound(7),
• 
  tftpAccessViolation(8)

77
Serial Configuration Table (serialConfigTable)

• This table contains one row for each serial
  interface on the probe
• serialMode incoming connection may be direct
  (1) or modem (2)
• serialProtocol data link protocol to use may be
  slip (2) or other (1)
• serialTimeout the number of seconds of
  inactivity allowed before terminating the
  connection on this interface
• serialModemInitString a control string that
  specifies the initialization string for this
  modem
• serialModemHangUpString a control string that
  specifies how to disconnect a modem connection on
  this interface
• serialModemConnectResp an ASCII string that
  describes the modem response code and associated
  bps rate
• serialModemNoConnectResp an ASCII string
  containing response codes that may be generated
  by a modem to report connection attempt failure
• serialDialoutTimeout timeout value for dialing
  out

78
Network Configuration Table (netConfigTable)

• This table contains one row for each network
  interface on the probe
• netConfigIpAddress IP address of this interface
• netConfigSubnetMask IP subnet mask of this
  interface
• In addition, a scalar object is associated with
  this table
• netDefaultGateway the IP address of the default
  gateway, or router

79
Trap Destination Table (trapDestTable)

• trapDestIndex a unique index for this row
• trapDestCommunity the community to which these
  destination IP addresses belong
• trapDestProtocol the protocol with which to
  send this trap, ip(1), ipx(2)
• trapDestAddress the IP address to which to send
  traps

80
Serial Connection Table (serialConnectionTable)

• This table stores the parameters needed for
  initiating a SLIP (Serial Line Interface
  Protocol) connection to a management station
• serialConnectIndex a unique index for this row
• serialConnectDestIpAddress the IP address that
  can be reached at the other end of this SLIP
  connection
• serialConnectType takes on the values direct
  (1), modem (2), switch (3), modemSwitch(4)
• serialConnectDialString a control string that
  specifies how to dial the phone number to
  establish a modem connection
• serialConnectSwitchConnectSeq a control string
  that specifies how to establish a data switch
  connection
• serialConnectDisconnectSeq a control string that
  specifies how to terminate a data switch
  connection
• serialConnectSwitchResetSeq a control string
  that specifies how to reset a data switch
  connection in the event of a timeout

81
Extensions to RMON1 for RMON2 Devices

• The RMON2 specification includes the definition
  of a number of objects to be added to RMON1
  tables
• A createTime object is added to all control
  tables
• A droppedFrames object is added to a number of
  tables, included as a filter object in all filter
  definitions
• The object filterProtocolDirLocalIndex is added
  to filter-Table

82
Extensions to RMON1 for RMON2 Devices
83
Extensions to RMON1 for RMON2 Devices
84
filterProtocolDirLocalIndex

• When this object is set to a non-zero value, the
  filter that it is associated with performs the
  following operations on every packet
• If the packet doesn't match the protocol
  directory entry, discard and exit.
• If the associated filterProtocolDirLocalIndex is
  non-zero and the packet doesn't match the
  protocol directory entry, discard the packet and
  exit.
• If the packet matches, perform the regular filter
  algorithm as if the beginning of the named
  protocol is the beginning of the packet,
  potentially applying the filterOffset value to
  move further into the packet.