Check out our White Paper Series!
A complete library of helpful advice and survival guides for every aspect of system monitoring and control.
1-800-693-0351
Have a specific question? Ask our team of expert engineers and get a specific answer!
Sign up for the next DPS Factory Training!
Whether you're new to our equipment or you've used it for years, DPS factory training is the best way to get more from your monitoring.
Reserve Your Seat TodayHaving a remote monitoring system in place is critical to ensure a stable and efficient network operation. In fact, having visibility over your mission-critical devices will improve your company's efficiency and bottom line.
For that, system technicians use network management tools that monitor the activity and performance of mission-critical equipment and network traffic. A common network management tool is the Simple Network Management Protocol (SNMP) along with remote network monitoring (RMON, which is an extension of SNMP) probe to gather and manage network data.
In order to properly use these tools in RMON networks to optimize your network performance, you first need to know their nuts and bolts. In this article, we will talk about what exactly RMON is and how it can help you enhance the efficiency of your remote monitoring systems. So, let's dive in.
Remote network monitoring (RMON) is a method of monitoring network traffic on a remote Ethernet transport to find network issues. These issues can be dropped packets, network collisions, and even traffic congestion.
This successful network management protocol was originally developed by the Internet Engineering Task Force (IETF) in the early 1990s. IETF is an open organization consisting of network designers, operators, vendors and researchers, that develops and promotes voluntary internet standards.
RMON was developed specifically to address the weak points of a standard MIB, which lacked the ability to provide statistics on data link and physical layer parameters. RMON is designed to help network technicians to remotely monitor and analyze data that is collected from local area networks (LANs) without having to go to distant facilities to set up equipment.
With RMON, you can set performance thresholds and create alerts when these thresholds are crossed. This allows you to maintain a proactive network management strategy.
RMON probes, also called RMON agents, are hardware/software elements of a network device or a software embedded into this device, like a router or a switch.
Usually, the RMON probe is put on just one device or interface on a TCP/IP subnet. The probe software typically runs on the port of the network device to get information and statistics on network protocols and traffic activity. It can pass this information back to your SNMP manager console for analysis and reporting.
With RMON, you and your techs can monitor your network, save logs, create historic performance reports, and get notified in case an issue happens. All without interfering with your daily operations.
Simple Network Management Protocol (SNMP) is an application-layer communication protocol used for monitoring and managing network devices on LANs or wide area networks (WANs). Sometimes, SNMP is even used to remotely control and configure remote equipment.
SNMP agents are usually the network devices that will allow communication between managed equipment and SNMP manager.
As I've said previously, RMON is an extension of SNMP and has nine groups of monitoring elements to allow you to capture all the details about your network information. This data refers to the physical layer (Layer 1) and the data-link layer (Layer 2) of the OSI model. As RMON agents monitor data over LAN networks, the gathered information is accessed by the SNMP manager using SNMP commands.
The SNMP protocol was originally developed as a tool for managing Transmission Control Protocol/Internet Protocol (TCP/IP), and Ethernet gateway, an extension of SNMP, was designed to allow monitoring of remote networks.
An SNMP device (a hub or router for example) normally needs additional software installed on it to give you RMON capabilities and turn it into a probe.
RMON has two different network monitoring specifications. They are:
RMON1 Management Information Base (MIB) provides network technicians with information about the health and performance of the network segment on which the RMON agent resides. This version gives you a view of the health of the whole segment, rather than the device-specific information that many non-RMON SNMP agents provide.
The benefits of RMON are obvious, but the scope of RMON1 is limited because it only focuses on the data link and physical layer parameters.
| RMON Ethernet Groups | |
| Group | Description |
| Statistics | Tracks packets, octets, packet-size distribution, broadcasts, collisions, dropped packets, fragments, CRC/alignment errors, jabbers, and undersized and oversized packets. |
| History | Stores multiple samples of values from the Statistics group for the comparison of the current behavior of a selected variable to its performance over the specified period. |
| Alarms | Enables setting thresholds and sampling intervals on any statistic to create an alarm condition. Threshold values can be an absolute value, a rising or falling value, or a delta value |
| Hosts | Provides a table for each active node that includes a variety of node statistics including packets and octets in and out, multicast and broadcast packets in and out, and error counts. |
| Host Top N | Extends the host table to offer a user-defined study of sorted host statistics. Host Top N is calculated locally by the agent, thus reducing network traffic and processing on the NMS. |
| Matrix | Displays the amount of traffic and the number of errors occurring between pairs of nodes within a segment. |
| Filters | Lets the user define specific packet-match filters and have them serve as a stop or start mechanism for packet-capture activity. |
| Packet Capture | Packets that pass the filters are captured and stored for further analysis. An NMS can request the capture buffer and analyze the packets. |
| Events | Lets the user create entries in a monitor log or generate SNMP traps from the agent to the NMS. Events can be initiated by a crossed threshold on a counter or by a packet-match count. |
RMON2 is an extension of RMON1. It adds nine more groups of data that pertain to the network layer (Layer 3) and application layer (Layer 7) of the OSI model.
RMON2 MIB gives you insights into RMON1 traffic statistics by specifying the protocol and applications that compose that traffic. Knowing this is vital in order to maintain and troubleshoot slave/master systems.
This version focuses mainly on higher traffic layers that exist above the medium access control (MAC) layer, Internet Protocol (IP) and application-level traffic. RMON2 facilitates network management applications to track all network layer packets.
| RMON2 Groups | |
| Group | Description |
| Protocol Directory | Provides a list of protocols supported by the device |
| Protocol Distribution | Contains traffic statistics for each supported protocol |
| Address Mapping | Contains network layer to MAC layer address mapping |
| Network Layer Host | Contains statistics for network layer traffic to or from each host |
| Network Layer Matrix | Contains network layer traffic statistics for conversations between pairs of hosts |
| Application Layer Host | Contains statistics for application layer traffic to or from each host |
| Application Layer Matrix | Contains application layer traffic statistics for conversations between pairs of hosts |
| User History Collection | Contains periodic samples of user-specified variables |
| Probe Configuration | Provides a standard way to remotely configure probe parameters such as trap destination and out-of-band management |
Also, RMON2 agents are able to monitor the traffic coming to the LAN through routers and not just at the LAN to which it is attached.
However, keep in mind that RMON2 is not an upgraded version of RMON1 and certainly is not a replacement. In order to have complete visibility over your network, it's important that you have the capabilities of both specifications.
The "Undersize Packets" channel focuses on monitoring the quantity of data packets that are smaller than the minimum Ethernet frame size, which is typically 64 bytes. This metric is important because an increased number of undersize packets can indicate network issues such as hardware faults, misconfigurations, or potential security threats.
Monitoring "undersize packets" protects your network health by identifying potential problems in the network infrastructure. Monitoring "undersize packets" also increases the security of your system. Unusually small packets may suggest malicious activities like network scanning, so having a system that can monitor these will help prevent these threats.
This monitoring also improves performance as frequent "undersize packets" can affect data transmission efficiency, leading to slower network performance. Understanding and monitoring the "Undersize Packets" channel is vital for maintaining a robust, efficient, and secure network environment.
Similarly, the "Transmitted" channel measures the volume of data that is sent out from a device or network over a certain period. It's a key performance indicator for network administrators who need to monitor and manage the flow of outgoing traffic.
The RMON Management Information Base is a more flexible and cost-effective solution to monitoring your network performance with proprietary protocols currently on the market. But, to get the most out of your remote monitoring system, you need a competent multiprotocol SNMP manager.
And the T/Mon LNX is just that. This master station's network visibility capabilities allow you and your team to remotely identify potential problem sources on the network so they can be solved quickly or even before they grow into bigger issues.
With the T/Mon, you'll have all the monitoring capabilities you need in only one interface. You'll be able to easily manage your SNMP-enabled devices alongside any other equipment running on different protocols.
And that's not all, to know more about the T/Mon and to get a free demo, give us a call.
Morgana Siggins
Morgana Siggins is a marketing writer, content creator, and documentation specialist at DPS Telecom. She has created over 200 blog articles and videos sharing her years of experience in the remote monitoring industry.
