Network Computingwww.networkcomputing.com

Inside RMON 2
The IETF finalized the RMON2 standard (RFC 2021) in January 1997. It extends the original RMON standard (RFC 1757), which defined a way for an SNMP-based network management station to gather network statistics remotely from probe devices placed on strategic segments of the network.

The original comprised 10 functional groups, all derived from the 16th branch of the MIB II tree:

1 Statistics: Ethernet utilization and error stats.

2 History: Same as statistics, but allows for storage of user-defined samples or deltas on the probe.

3  Alarm: Works with the event group to send traps based on thresholds.

4 Hosts: Ethernet statistics per MAC (Media Access Control) address.

5 HostTopN: Same as Hosts, but provides the ability for probe to perform TopN reports.

6 Matrix: Ethernet statistics per MAC address conversation.

7 Filter: Works with the capture group to capture packets for analysis.

8 Capture: Works with the filter group to capture packets for analysis.

9 Event: Works with the alarm group to send traps based on thresholds.

10 Token Ring: Provides another set of statistics for token-ring networks.

The problem with RMON is that though it does a good job of summarizing things like utilization and various error counts for each device on a network, it cannot summarize any data above Layer 2 (the data link layer), so conversations between a server and various devices on another routed network would show up as a conversation between the server and the router. This makes it impossible to determine which devices and networks are talking to the server. In addition, RMON cannot break down network usage by protocol and application.

Until RMON2 came along, vendors' solutions to this problem incorporated proprietary extensions. Now, thanks to 10 new RMON groups, numbered 11 through 20, RMON2 standardizes the way this information is provided and addresses other shortcomings of RMON:

11 protocolDir: A table of all identifiable protocols, plus their descriptions.

12 protocolDist: Counters of all detected protocols.

13 addressMap: Mapping of Layer 3 address to corresponding MAC address.

14 nlHost: Total traffic based on network address.

15 nlMatrix: Total traffic based on network-layer conversation pairs; includes TopN capability.

16 alHost: Same as nlHost, except that traffic broken down by protocols can be recognized by ProtocolDir.

17 alMatrix: Same as nlMatrix, except that conversation traffic broken down by protocols can be recognized b y ProtocolDir.

18 userHistory: Enables the probe to save samples of RMON2 data.

19 probeConfig: Provides remote capability for performing all tasks that normally require a direct serial connection, such as resets, software updates, IP address changes and trap destinations.

20 rmonConformance: Provides information to management software regarding the status of support for the groups.

These new groups make it possible to view traffic patterns at the network level (OSI Layer 3). They also make it possible to understand protocol and application usage associated with the network as a whole, as well as each individual node.