Remote Network Monitoring (RMON)

1
Remote Network Monitoring (RMON)

• Mi-Jung Choi
• Dept. of Computer Science
• KNU
• Email mjchoi_at_kangwon.ac.kr

2
Table of Contents

• Basic Concepts
• RMON Goals
• RMON MIB Table Management
• RMON MIB Groups
• RMON2

3
RMON Basic Concepts

• Extends the SNMP functionality without changing
  the protocol
• Allows the monitoring of remote networks
  (internetwork management)
• MAC-layer (layer 2 in OSI) monitoring
• Defines a Remote MONitoring (RMON) MIB that
  supplements MIB-II
• with MIB-II, the manager can obtain information
  on individual devices only
• with RMON MIB, the manager can obtain information
  on the LAN as a whole
• called network monitors, analyzers or probes

4
RMON RFCs
5
RMON Goals

• Monitoring subnetwork-wide behavior
• Reducing the burden on agents and managers
• Continuous off-line monitoring in the presence of
  failures (in network or manager)
• Proactive monitoring
• perform some of the manager functions (e.g.,
  diagnostics)
• Problem detection and reporting
• Provide value-added (analyzed) data
• Support multiple managers

6
Example Configuration for Remote Monitoring
Management console with RMON probe
Ethernet
Central Site
Router
Router
Local management console with RMON probe
Router
Router
Ethernet
PC with RMON probe
FDDI backbone
Bridge
Router with RMON probe
Ethernet
Token Ring LAN
PC with RMON probe
7
Example of RMON probe with two interfaces
8
Control of Remote Monitors

• RMON MIB contains features that support extensive
  control from NMS
• Configuration control
• Action Invocation
• RMON MIB is organized into a number of functional
  groups
• Each group may contain one or more control tables
  and one or more data tables
• Control table (typically read-write) contains
  parameters that describe the data in a data table
  (typically read-only)

9
Configuration Control

• At configuration time, NMS sets the appropriate
  control parameters to configure the remote
  monitor to collect the desired data
• the parameters are set by adding a new row to the
  control table or by modifying an existing row
• a control table may contain objects that specify
  the source of data to be collected, the type of
  data, the collection timing, etc.
• To modify or disable a particular data collection
  function
• it is necessary first to invalidate the control
  row
• this causes the deletion of that row and the
  deletion of all associated rows in data tables
• NMS can create a new control row with the
  modified parameters

10
RMON MIB Table Mgmt (1)

• The RMON specification includes a set of textual
  conventions and procedural rules for row addition
  and deletion
• Textual conventions
• OwnerString DisplayString
• EntryStatus INTEGER
• valid (1),
• createRequest (2),
• underCreation (3),
• invalid (4)

11
RMON MIB Table Mgmt (2)

• Row Addition
• is achieved by using the SNMP SetRequest PDU
  which includes instance objects and their values
• Row Deletion
• is achieved by setting the status object for that
  row to invalid
• Row Modification
• is achieved by first invalidating the row and
  then adding the row with new object instance
  values

12
Example Control Data Tables
rm1ControlTable
rmlControlIndex
rmlControlParameter
rmlControlOwner
rmlControlStatus
1
5
monitor
valid (1)
2
26
manager alpha
valid (1)
3
19
manager beta
valid (1)
rm1DataTable
rmlDataControlIndex
rmlDataIndex
rmlDataValue
1
46
1
1
96
2
2
85
2
3
77
2
4
27
2
5
92
2
1
86
3
2
26
3
13
Transitions of EntryStatus State
non- existent
valid
invalid
performed by manager
performed by agent
14
RMON MIB
15
RMON MIB Groups

• 1. statistics maintains MAC-level utilization
  and error stats
• 2. history records periodic statistical samples
  from the stats group
• 3. alarm allows NMS to set sampling interval
  alarm threshold
• 4. host contains counters for traffic from hosts
  on the subnetwork
• 5. hostTopN contains sorted host stats that top
  a list based on some parameter in the host table
• 6. matrix shows utilization and error stats in
  matrix for host pairs
• 7. filter allows the monitor to observe packets
  that match a filter
• 8. capture specifies how data is sent to NMS
• 9. event specifies events to be generated by the
  RMON probe
• 10. tokenRing maintains stats config info for
  token ring subnet

16
RMON MIB2

• RMON MIB monitors MAC-level subnet traffic
• RMON MIB2 can monitor traffic of packets at
  layers 3 to 7 of the OSI Reference Model
• Provides Network-layer Visibility
• can distinguish between local LAN and remote LAN
  traffic
• Provides Application-layer Visibility
• can analyze traffic to and from hosts for
  particular applications
• can determine which applications are putting the
  load on the net
• RMON MIB2 is basically an extension of RMON MIB

17
RMON MIB2
18
RMON MIB2 Groups

• 11. protocolDir a master directory of all of the
  protocols that the probe can interpret
• 12. protocolDist aggregate stats on the amount
  of traffic generated by each protocol, per LAN
  segment
• 13. addressMap contains MAC and port addresses
  of the devices
• 14. nlHost network layer traffic stats per host
• 15. nlMatrix network layer traffic stats per
  pairs of hosts
• 16. alHost application layer traffic stats per
  host
• 17. alMatrix application layer traffic stats per
  pairs of hosts
• 18. userHistory periodically samples and logs
  user-defined data
• 19. probeConfig defines standard configuration
  parameters for RMON probes

19
Summary

• RMON extends the SNMP functionality without
  changing the protocol
• RMON can monitor information on a whole
  subnetwork
• RMON is used extensively in analyzing network
  traffic for problem detection and network
  planning
• RMON2 allows monitoring of traffic at layers 3 to
  7 in the OSI Model
• RMON2 can be used to analyze network traffic more
  accurately even to the application level
• Read Chapters 8, 9 and 10