Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow...
Transcript of Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow...
![Page 1: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/1.jpg)
RMON MIB
Presenter: Andreas Pitsillides
1Based on presentation by Rouf Boutaba
![Page 2: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/2.jpg)
The RMON MIB Objectives
Introduction
Segment Statistics
Host Statistics
Other RMON MIB Groups
Summary
2
![Page 3: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/3.jpg)
RMON MIB - Objectives
3
• study the origins of the RMON MIB
• outline the objects provided in the segment statistics and history groups
• describe RMON object groups providing host statistics
• give few general management groups of RMON MIB objects
![Page 4: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/4.jpg)
Introducing the RMON MIB
4
MIB
MIB-1 MIB-2 RMON
RMONAgent
IETF WG + (NMS + MA) Vendors
![Page 5: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/5.jpg)
RMON Goals
5
• RMON standard specification to allow communication between SNMP-based management consoles and remote monitors, called RMON Agents• Remote monitors are devices traditionally employed to study traffic on a network as a whole. They are traditionally referred to as network monitors, network analyzers, or probes
• Hence, RMON provides effective & efficient way to monitor sub-network behavior (MIB-2 cannot easily learn about the traffic on the LAN as a whole).
• Advantages:
reduce burden both on other Agents and on NMSs off-line operation, i.e. without polling from managers, to save communications costs proactive monitoring, e.g. by running diagnostics and logging network performancesmultiple managers for reliability, to perform different functions, ...
![Page 6: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/6.jpg)
Example Configuration using RMON
6
Ethernet
FDDI
TokenRing
Ethernet
Ethernet
Management consolewith RMON
RMON Probe
Router
Router
Router
Router
Bridge
Hub withRMON Probe
Router withRMON Probe
Management consolewith RMON
Local Management console with RMON
Management consolewith RMON
RMON Probe
![Page 7: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/7.jpg)
The RMON Standard
7
(1)Segmentstatistics (2)
History
(3)Hosttable (4)
Hosttop n
(7)Filters
(9)Events
(5)Trafficmatrix (6)
Alarms(8)
Packetcapture
RMONMIB
RMON standard conformance :requires support for every object within a selected group only.
![Page 8: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/8.jpg)
statistics Group
8
(1)Segmentstatistics (2)
History
(3)Hosttable (4)
Hosttop n
(7)Filters
(9)Events
(5)Trafficmatrix (6)
Alarms(8)
Packetcapture
RMONMIB
maintains low-level utilization and error statistics for each sub-network monitored by the agent.
Each statistics object is maintained in a 32-bit cumulative counter. Will be possibly extended to 64-bit counters.
![Page 9: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/9.jpg)
statistics Group
9
(1)Segmentstatistics
(2) (3) (4) (7) (9)(5) (6) (8)
Segment-level Ethernet statistics (counters)
(5)Packets
(4)Bytes
(6)Broadcasts
(13)Collisions
11001000
Number of data bytesreceived
Number ofpkts received
(All kinds) Number ofgood broadcastpkts received
(7)Multicasts
Number ofgood multicastpkts received
Total number ofcollisions
... ......
+ statistics also maintained on number of packets dropped by the agent+ object maintaining a real-time packet size counter, ...
![Page 10: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/10.jpg)
history Group
10
(1)Segmentstatistics (2)
History
(3)Hosttable (4)
Hosttop n
(7)Filters
(9)Events
(5)Trafficmatrix (6)
Alarms(8)
Packetcapture
RMONMIB
provides historical records of the statistics generated by objects in the statistics group (except packet size distribution object).
also allows the user to define sample intervals and bucket counters for customization and trend analysis :
![Page 11: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/11.jpg)
host table Group
11
(1)Segmentstatistics (2)
History
(3)Hosttable (4)
Hosttop n
(7)Filters
(9)Events
(5)Trafficmatrix (6)
Alarms(8)
Packetcapture
RMONMIB
contains counters for various types of trafficto and from hosts attached to the sub-network
![Page 12: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/12.jpg)
host table Group
12
(1) (2) (3)Hosttable
(4) (7) (9)(5) (6) (8)
Counters of various types of traffic
Packetssent
Packetsreceived
Bytessent
11001000
Bytesreceived
11001000
Broadcastsent
Multicastsent
Errorpacket
sent
![Page 13: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/13.jpg)
error sent Object
13
(1) (2) (3)Host table
(4) (7) (9)(5) (6) (8)
Errorpacket
sent
Packetssent
Packetsreceived
Bytessent
Bytesreceived
Broadcastsent
UndersizedCRC alignmentOversized Fragments
![Page 14: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/14.jpg)
host top n Group
14
(1)Segmentstatistics (2)
History
(3)Hosttable (4)
Hosttop n
(7)Filters
(9)Events
(5)Trafficmatrix (6)
Alarms(8)
Packetcapture
RMONMIB
an additional group providing host statistics. e.g., “Printer active”, “Network link active”.
it extends the host table with sorted host statistics,Examples:- Top 10 nodes sending packets.- List of nodes ordered according to errors they’ve sent in the last hour.
![Page 15: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/15.jpg)
traffic matrix Group
15
(1)Segmentstatistics (2)
History
(3)Hosttable (4)
Hosttop n
(7)Filters
(9)Events
(5)Trafficmatrix (6)
Alarms(8)
Packetcapture
RMONMIB
record traffic information between pairs of hosts on a sub-network.
error and utilization, e.g. traffic amount, number of errors
in a matrix form, so the operator can retrieve information for any pair of network addresses, e.g., to find which devices are making the most use of a server
![Page 16: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/16.jpg)
traffic matrix Group
16
(1) (2) (3) (4) (7) (9)(5)Traffic matrix
(6) (8)
Example: using RMON MIB traffic matrix group in Ethernet MAC layer
pairwise traffic information
Traffic
NodeNodes Y
Nod
esX
Amount of trafficbetween X and Y
Number of errorsbetween X and Y
Counters (packets, bytes)
Counter (errors #)
sorted by source or by destination
![Page 17: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/17.jpg)
alarms Group
17
(1)Segmentstatistics (2)
History
(3)Hosttable (4)
Hosttop n
(7)Filters
(9)Events
(5)Trafficmatrix (6)
Alarms(8)
Packetcapture
RMONMIB
allows the management console user to set a sampling interval and alarm threshold for any counter or integer recorded by RMON.
these allow you to define the events to be registered by the counter/integer
![Page 18: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/18.jpg)
alarm Group
18
(1) (2) (3) (4) (7) (9)(5) (6)Alarm
(8)
Example: if there are more than 200 CRC errors (the threshold) in any 5-minute period(the sampling interval), an alarm is generated and sent to the central console.
Sampled objectvalue
Time
Risingthreshold
Fallingthreshold
![Page 19: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/19.jpg)
filters Group
19
(1)Segmentstatistics
(2)History
(3)Hosttable
(4)Hosttop n
(7)Filters
(9)Events
(5)Trafficmatrix
(6)Alarms
(8)Packetcapture
RMONMIB
allows the monitor to observe selected packets (i.e., packets that match a filter) on a particular interface (i.e., a sub-network).
Filter engine
Channel
![Page 20: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/20.jpg)
filter Group
20
(1) (2) (3) (4) (7)Filter
(9)(5) (6) (8)
Example 1: data filtersscreen observed packets on the basis of a bit pattern that a portion of the packet matches (or fail to match) Example 2: status filtersscreen observed packets on the basis of their status (e.g., valid, CRC error, …)Example N: … OR … AND … any combination of above using logical OR, AND, XOR, ...
the monitor may capture packets that pass the filter or simply record statistics based on such packets
the filter engine allows to activate packet capture function and events, which are important to most RMON other groups and advanced functions
![Page 21: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/21.jpg)
packet capture Group
21
RMONMIB
can be used to set up a buffering scheme for capturing packets from one of the channels in the filter group -> governs how data is sent to the management console and when
(1)Segmentstatistics
(2)History
(3)Hosttable
(4)Hosttop n
(7)Filters
(9)Events
(5)Trafficmatrix
(6)Alarms
(8)Packetcapture
Packet capturefunctions & events
Captured packetsCaptured packets
![Page 22: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/22.jpg)
event Group
22
(1)Segmentstatistics (2)
History
(3)Hosttable (4)
Hosttop n
(7)Filters
(9)Events
(5)Trafficmatrix (6)
Alarms(8)
Packetcapture
RMONMIB
supports the definition of events and gives a table of all events generated by the RMON probe.
An event is triggered by a condition located elsewhere in the MIB, and an event can trigger an action defined elsewhere in the MIB
![Page 23: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/23.jpg)
event Group
23
(1) (2) (3) (4) (7) Event (9)(5) (6) (8)
An event may cause information to be logged in this group and may cause an SNMP trapmessage to be issued.
A probe log includes the time at which each event occurred as well as a description of the event
eventIndex:eventDescription:eventType:eventCommunity:...
Traps are error trapping contained in SNMP messages
from agent to NMS
Conditions of an event to occur are defined in other RMON groups E.g.: alarm group can define threshold event referenced by indexing in eventTableE.g.: filter group can reference an event that will occur when a packet is captured
![Page 24: Topic 10 RMON MIB - Computer Science 10 RMON MIB.pdf · •RMON standard specification to allow communication between SNMP- ... RMON MIB RMON standard conformance : ... between X](https://reader034.fdocuments.in/reader034/viewer/2022052303/5ba5f6ab09d3f21e528b4cf4/html5/thumbnails/24.jpg)
Summary on RMON MIB
24
The RMON MIB was developed by the IETF. It consists of nine groups of objects.
Compliance with RMON MIB standard only requires support for one object from within each group.
Segment statistics provides segment-level Ethernet statistics on packets, bytes, broadcasts, multicasts, collisions and packet size distribution. The history group provides customized historical data on most of these.
The RMON MIB provides the host table and host top n groups containing objects for a range of host statistics.
The RMON MIB also provides: a traffic matrix group for statistics on traffic between pairs of nodes an alarms group for setting thresholds and sampling intervals a filters group for activating packet capture functions and events a packet capture group for capturing LAN packets an event group for creating log entries and traps