Specifications

Introduction 1-16

NAM / Traffic Analyzer v3.5 Tutorial

Introduction 1-16

NAM / Traffic Analyzer v3.5 Tutorial

Network Performance Monitoring

Understanding MIBs - RMON I MIB (Layers 1 & 2)

Network Performance Monitoring

Understanding MIBs - RMON I MIB (Layers 1 & 2)

» Real Time Physical and Data Link Layer Statistics

» Statistics Over Time

» Predetermined Thresholds Set on Statistics

» Talker Statistics – Data Link Layer

» Top N Talkers - Data Link Layer

» Conversation Statistics– Data Link Layer

» Packet Structure and Content Matching

» Packet Capture for later analysis

» Reaction to Predetermined Conditions (threshold reached)

» Token Ring - RMON Extensions

statistics

history

alarm

host

hostTopN

matrix

filter

capture

event

tokenRing

Mini-RMON – Can be enabled on all Cisco Catalyst ports

Understanding MIBs – RMON I MIB

One such MIB is the RMON I (Remote Monitoring) MIB. The RMON MIB is a standard MIB included as a

subtree off the MIB2 subtree. RMON, in brief, collects the following:

• Basic layer statistics - line utilization, packets, and errors; and protocol utilization and packets

• Host Statistics – byte and packet counts to and from a host (by MAC address at the data link layer,

network address at the network layer, and network address at the application layer).

• Conversation statistics - byte and packet counts from one host to another (by MAC address at the

data link layer, network address at the network layer, and network address at the application layer).

• Packet Capture – RMON can be used to capture a subset of network traffic for detailed protocol

analysis.

• Thresholds and Alarms – RMON can set up thresholds to look for various conditions (e.g. link

utilization greater than 70% for 60 seconds) and inform a management station with an SNMP trap

when the condition occurs.

Since the amount of statistics gathered per interface, most RMON implementations are in stand-alone

network devices often called RMON analyzers, such as the NAM. The exception to this is the use of a small

subset of RMON implemented on a switch to collect basic data-link layer statistics, a brief history of these

statistics, and the ability to set thresholds against the statistics all on a per port basis. This subset of RMON

is known as mini-RMON (Statistics, History, Alarms, and Events).