Remote Monitoring (RMON) is a standard monitoring specification that enables various network monitors and console systems to exchange network-monitoring data. RMON provides network administrators with more freedom in selecting network-monitoring probes and consoles with features that meet their particular networking needs.
RMON was originally developed to address the problem of managing LAN segments and remote sites from a central location. The RMON specification is an extension of the SNMP MIB. Within an RMON, network monitoring data is defined by a set of statistics and functions and exchanged between various different monitors and console systems. Resultant data is used to monitor network utilization for network planning and performance tuning, as well as assisting in network fault diagnosis.
There are 2 versions of RMON: RMONv1 and RMONv2. RMONv1, which can now be found on most modern network hardware, defined 9 MIB groups for basic network monitoring.. RMON2 is an extension of RMON that focuses on higher layers of traffic above the medium access control (MAC) layer. RMON2 has an emphasis on IP traffic and application level traffic. RMON2 allows network management applications to monitor packets on all network layers. This is different from RMONv1, which only allows network monitoring at MAC layer or below.
RMON solutions are comprised of two components: a probe (or an agent or a monitor), and a management station. Agents store network information within their RMON MIB and are normally found as embedded software on network hardware such as routers and switches although they can be a program running on a PC. Agents can only see the traffic that flows through them so they must be placed on each LAN segment or WAN link that is to be monitored. Clients, or management stations, communicate with the RMON agent or probe, using SNMP to obtain and correlate RMON data.
Now, there are a number of variations to the RMON MIB. For example, the Token Ring RMON MIB provides objects specific to managing Token Ring networks. The SMON MIB extends RMON by providing RMON analysis for switched networks.
Protocol Structure
The RMON1 and RMON2 are focused at different network layers:
The RMON1 and RMON2 are focused at different network layers
| RMON 1 MIB Group | Function | Elements |
| Statistics | Contains statistics measured by the probe for each monitored interface on this device. | Packets dropped, packets sent, bytes sent (octets), broadcast packets, multicast packets, CRC errors, runts, giants, fragments, jabbers, collisions, and counters for packets ranging from 64 to 128, 128 to 256, 256 to 512, 512 to 1024, and 1024 to 1518 bytes. |
| History | Records periodic statistical samples from a network and stores for retrieval. | Sample period, number of samples, items sampled. |
| Alarm | Periodically takes statistical samples and compares them with set thresholds for events generation. | Includes the alarm table and requires the implementation of the event group. Alarm type, interval, starting threshold, stop threshold.` |
| Host | Contains statistics associated with each host discovered on the network. | Host address, packets, and bytes received and transmitted, as well as broadcast, multicast, and error packets. |
| HostTopN | Prepares tables that describe the top hosts. | Statistics, host(s), sample start and stop periods, rate base, duration. |
| Matrix | Stores and retrieves statistics for conversations between sets of two addresses. | Source and destination address pairs and packets, bytes, and errors for each pair. |
| Filters | Enables packets to be matched by a filter equation for capturing or events. | Bit-filter type (mask or not mask), filter expression (bit level), conditional expression (and, or not) to other filters. |
| Packet Capture | Enables packets to be captured after they flow through a channel. | Size of buffer for captured packets, full status (alarm), number of captured packets. |
| Events | Controls the generation and notification of events from this device. | Event type, description, last time event sent |
| Token Ring | Support of Token Ring | (not used often) |
| RMON 2 MIB Group | Functions |
| Protocol Directory | The Protocol Directory is a simple and interoperable way for an RMON2 application to establish which protocols a particular RMON2 agent implements. This is especially important when the application and the agent are from different vendors |
| Protocol Distribution | Mapping the data collected by a probe to the correct protocol name that can then be displayed to the network manager. |
| Address mapping | Address translation between MAC-layer addresses and network-layer addresses which are much easier to read and remember. Address translation not only helps the network manager, it supports the SNMP management platform and will lead to improved topology maps. |
| Network Layer host | Network host (IP layer) statistics |
| Network layer matrix | Stores and retrieves network layer (IP layer) statistics for conversations between sets of two addresses. |
| Application layer host | Application host statistic |
| Application layer matrix | Stores and retrieves application layer statistics for conversations between sets of two addresses. |
| User history | This feature enables the network manager to configure history studies of any counter in the system, such as a specific history on a particular file server or a router-to-router connection |
| Probe configuration | This RMON2, feature enable one vendor"s RMON application to remotely configure another vendor"s RMON probe. |
Related Terms: SNMP, SNMPv1, SNMPv2, SNMPv3, SMI
Sponsor Source: RMON is defined by IETF (http://www.ietf.org) through a group of RFCs shown in the reference.
Reference:
http://www.javvin.com/protocol/rfc2819.pdf: Remote Network Monitoring Management Information Base
http://www.javvin.com/protocol/rfc4502.pdf: Remote Network Monitoring Management Information Base Version 2 using SMIv2
http://www.javvin.com/protocol/rfc1157.pdf: A Simple Network Management Protocol