MJ07/0704 1

Session 07RMON

Adapted from Network Management: Principles and Practice © Mani Subramanian 2000 and solely used for Network Management course at Universitas Bina Nusantara

MJ07/0704 2

RMON Components

• RMON Probe• Data gatherer - a physical device

• Data analyzer• Processor that analyzes data

• RMON Remote Network Monitoring• Standards-based network management protocol• Allows network information to be gathered at a single workstation• Defines additional MIBs to provide a richer set of data about network usage

DataAnalyzer

RMONProbe

BACKBONENETWORK

SNMPTraffic

SNMPTraffic

LAN

RouterRouter

MJ07/0704 3

Network with RMONs

FDDIBackbone Network

Remote Token Ring LAN

NMS

RouterBridge

Token RingProbe

EthernetProbe

Local LAN

Router withRMON

Router

Remote FDDI LAN

FDDI Probe

MJ07/0704 4

RMON Benefits

• Monitors and analyzes locally and relays data; less load on the network

• Needs no direct visibility by NMS; more reliable information

• Permits monitoring on a more frequent basis and hence faster fault diagnosis

• Increases productivity for administrators

MJ07/0704 5

RMON MIB

rmonConformance (20)

probeConfig (19)

usrHistory (18)

rmon (mib-2 16)

statistics (1)history (2)

alarm (3)host (4)

hostTopN (5)matrix (6)

filter (7)capture (8)

event (9)

a1Matrix (17)

a1Host (16)n1Matrix (15)

n1Host (14)

addressMap (13)protocolDist (12)

protocolDir (11)

Token Ring (10)

RMON1 Extension

RM

ON

1

RM

ON

2

MJ07/0704 6

• RMON1: Ethernet RMON groups • rmon 1 - rmon 9

• RMON1: Extension: Token ring extension • rmon 10

• RMON2: Higher layers (3-7) groups • rmon 11 - rmon 20

RMON MIB

MJ07/0704 7

RMON Groups and Functions

Host and Conversation Statistics

Token Ring Statistics

Ethernet Statistics

Filter Group

RemotelyMonitoredNetwork

DataGathering

PacketFiltering

ChannelFiltering

PacketCapture

NetworkManager

AlarmGeneration

EventGeneration

HostStatistics

HostTopNStatistics

EthernetStatistics

EthernetHistory

Token RingStatistics

Token RingHistory

MatrixStatistics

HistoryControl

HistoryControl

MJ07/0704 8

• Probe gathers data• Functions

• Statistics on Ethernet, token ring, and hosts / conversations• Filter group filters data prior to capture of data• Generation of alarms and events

RMON Groups and Functions

MJ07/0704 9

RMON1 MIB Groups & Tables

Group OID Function TablesStatistics rmon 1 Link level statistics -etherStatsTable

-etherStats2TableHistory rmon 2 Periodic statistical data

collection and storagefor later retrieval

-historyControlTable-etherHistoryTable-historyControl2Table-etherHistory2Table

Alarm rmon 3 Generates events whenthe data samplegathered crosses pre-established thresholds

-alarmTable

Host rmon 4 Gathers statistical dataon hosts

-hostControlTable-hostTable-hostTimeTable-hostControl2Table

HostTopN rmon 5 Computes the top Nhosts on the respectivecategories of statisticsgathered

-hostTopNcontrolTable

MJ07/0704 10

Group OID Function TablesMatrix rmon 6 Statistics on traffic

between pair of hosts-matrixControlTable-matrixSDTable-matrixDSTable-matrixControl2Table

Filter rmon 7 Filter function thatenables capture ofdesired parameters

-filterTable-channelTable-filter2Table-channel2Table

PacketCapture

rmon 8 Packet capture capabilityto gather packets afterthey flow through achannel

-buffercontrolTable-captureBufferTable

Event rmon 9 Controls the generation ofevents and notifications

-eventTable

TokenRing

rmon 10

RMON1 MIB Groups & Tables

MJ07/0704 11

• Ten groups divided into three categories• Statistics groups (rmon 1, 2, 4, 5, 6, and 10)• Event reporting groups (rmon 3 and 9)• Filter and packet capture groups(rmon 7 and 8)

• Groups with “2” in the name are enhancements with RMON2

RMON1 MIB Groups & Tables

MJ07/0704 12

Control and Data Tables

dataIndex

dataIndex

controlTableSize

controlTable

controlEntry

controlOwner

controlStatus

dataEntry

dataAddlIndex

controlDataSource

controlOther

controlTableSize

controlOwner

controlStatus

controlDataSource

controlOther

dataOther

dataAddlIndex

dataOther

dataIndex

dataAddlIndex

dataOther

dataIndex

dataAddlIndex

dataOther

dataTable

controlIndex

controlIndex

• Control table used to set the instances of data rows in the data table • Values of data index and control index are the same

MJ07/0704 13

Host Top N Group Example

HostTopN

0 100 200 300 400

Host 10

Host 9

Host 8

Host 7

Host 6

Host 5

Host 4

Host 3

Host 2

Host 1

Giga Octets

MJ07/0704 14

Filter Group

filterChannel

Index= 2

FilterIndex= 2

FilterIndex

= 1

channelIndex =1

channelTable

channelEntry

channel

IfIndex = 1

channel

AcceptType

filterEntry

filterChannel

Index= 1

channelData

Control

channelIndex = 2

channelIfIndex

channel

AcceptType

channelData

Control

Filter

Parameters

filterChannel

Index= 1

Filter

Parameters

FilterIndex= 3

Filter

Parameters

FilterIndex= 4

filterChannel

Index= 2

Filter

Parameters

filterTable

Other

ChannelParameters

OtherChannel

Parameters

MJ07/0704 15

• Filter group used to capture packets defined by logical expressions

• Channel is a stream of data captured based on a logical expression

• Filter table allows packets to be filtered with an arbitrary filter expression

• A row in the channel table associated with multiple rows in the filter table

Filter Group

MJ07/0704 16

Packet Capture Group

CaptureBufferTable(One entryper

Channel)

Filter Table(many

for each

channel)

ChannelTable

• Packet capture group is a post-filter group• Buffer control table used to select channels• Captured data stored in the capture buffer table

MJ07/0704 17

RMON2

• Applicable to Layers 3 and above• Functions similar to RMON1• Enhancement to RMON1• Defined conformance and compliance

MJ07/0704 18

RMON2 MIB

Group OID Function TablesProtocolDirectory

rmon 11 Inventory of protocols protocolDirTable

ProtocolDistribution

rmon 12 Relative statistics onoctets and packets

protocolDistControlTableprotocolDistStatsTable

AddressMap

rmon 13 Mac address tonetwork address on theinterfaces

addressMapControlTableaddressMapTable

NetworkLayer Host

rmon 14 Traffic data from and toeach host

n1HostControlTablen1HostTable

MJ07/0704 19

RMON2 MIB

Group OID Function TablesApplicationLayer Matrix

rmon 17 Traffic data byprotocol betweenpairs of hosts

a1MatrixSDTablea1MatrixDSTablea1MatrixTopNControlTablea1MatrixTopNTable

User HistoryCollection

rmon 18 User-specifiedhistorical data onalarms andstatistics

usrHistoryControlTableusrHistoryObjectTableusrHistoryTable

ProbeConfiguration

rmon 19 Configuration ofprobe parameters

serialConfigTablenetConfigTabletrapDestTableserialConnectionTable

RMONConformance

rmon 20 RMON2 MIBCompliances andCompliance Groups

MJ07/0704 20

RMON TR Extension Groups

• Two statistics groups and associated history groups• MAC layer (Statistics group) collects TR parameters • Promiscuous Statistics group collects packets promiscuously on sizes and types of packets

• Three groups associated with the stations• Routing group gathers on routing

MJ07/0704 21

ATM RMON

Upper Layer ProtocolsRMON-2

(RFC 2021, 2074)

EthernetRMON

(RFC 1757)

Token RingRMON

(RFC 1513)

ATM Protocol IDs forRMON-2

(Additions to RFC 2074)

SwitchExtensionsfor RMON

ATMRMON

'Base' Layer

Network Layer

ApplicationLayer

IETF MIBs Additional MIBs

MJ07/0704 22

• ATM Forum extended RMON to ATM• Switch extensions and ATM RMON define objects at

the base layer• ATM protocol IDs for RMON2 define additional

objects at the higher levels• ATM devices require cell-based measurements and

statistics• Probe should be able to handle high speed

ATM RMON

MJ07/0704 23

ATM Probe Location

ATMSwitch

RMONProbe

RMONProbe

ATMSwitch

(a) External Probe with copy (b) Internal Probe with copy

ATM Switchwith internal

RMON Probe

ATMSwitch

ATMSwitch

RMONProbe

(d) External Probe without copy(c) Internal Probe without copy

MJ07/0704 24

• Stand-alone probe in (a) copies the cells• Embedded version in (b) reports data, but has no

access to switch fabric• Internal probe (c) similar to (b) with access to switch• Stand-alone probe (d) taps network-to-network

interface between two ATM switches• (a) and (b) require duplex circuits, steering of traffic,

and design modification• Embedded designs (c) and (d) require no modification

ATM Probe Location

MJ07/0704 25

ATM RMON MIB Groups

Group OID Function TablesportSelect atmRmonMIBObjects1 Port Selection portSelGrpTable

portSelTableatmStats atmRmonMIBObjects2 Basic Statistics atmStatsControlTable

atmStatsTableatmHost atmRmonMIBObjects3 ATM per-host

statisticsatmHostControlTableatmHostTable

atmMatrix atmRmonMIBObjects4 ATM per-circuitstatistics

atmMatrixControlTableatmMatrixSDTableatmMatrixDSTableatmMatrixTopNControlTableatmMatrixTopNTable

MJ07/0704 26

• ATM RMON MIB contains four groups• portSelect group selects ports• atmStats collects basic statistics based on port

selection• atmHost gathers statistics based on host traffic• atmMatrix group collects conversation traffic

and ranks the top-N entries

ATM RMON MIB Groups