Network Management

RMON2

RMON2 - overview

RMON2 decodes packets at layers 3-7 of the OSI. This enables the probe to monitor traffic based on 1. network layer protocols and (2)application level traffic Network Layer visibility - capability to see above the MAC layer. The network manager can answer a number of new questions: what networks or hosts account for the bulk of incoming traffic? If a router is overloaded, who is the source and destination of that load? Application-Level visibility the probe is capable of reading the headers at the application protocol level. The RMON2 specification calls all protocols above IP as application layer protocols.

RMON2 MIBs

protocolDir a master directory of all the protocols that the probe can interpret .protocolDist aggregate statistics on the amount of traffic generated by each protocol per lan segment addressMap matches each network address to a specific MAC address nlHost statistics on the amount of traffic into and out of hosts on the basis of network layer address nlMatrix statistics on the amount of traffic between pairs of hosts on the basis of network layer address alHost statistics on the amount of traffic into and out of hosts based on the application level address alMatrix statistics on the amount of traffic between pairs of hosts on the basis of application level address usrHistory periodically samples user-specified variables and logs that data based on user-defined parameters probeConfig defines standard configuration parameters for RMON probes

RMON2 New features

RMON2 introduced two new features not found in RMON1 Indexing with External Objects Time Filter Indexing

RMON2 Indexing with External Objects

In SNMPv1, it is not clear, whether an INDEX object is required to be a columnar object in the table that it indexes (v2 clearly states that it is possible). In such a case the Description clause for a conceptual must include a textual explanation of how such objects are to be used. RMON2 adopts this means of indexing and uses it frequently to tie together control tables and data tables. See Fig. 8.2 and 10.2 to compare old and new schemes.

RMON2 Time Filter Indexing

A common function of a network mgmt application is periodically to poll all probes subordinate to it for the values of objects maintained at the probe. For the sake of efficiency, it is desirable to have the probe return values for only those objects whose values have changed since the last poll. RMON2 achieves it as follows:

An object of Type TimeFilter has the syntax of timeticks but is used exclusively as an index to a table. The purpose of this index is to enable a manager to download from a probes table only those rows that have changed since a specified time. That time is specified in the value of the TimeFilter index object.