Understanding RMON and RMON2

RMON

RMON provides packet statistics collection and alarm functions. Management devices use RMON to remotely monitor and manage network elements. RMON contains four groups (statistics, history, alarm, and event) and a fifth Huawei-defined extended alarm group.

RMON uses the statistics and history groups to provide Ethernet and history statistics collection respectively.

• Ethernet statistics (statistics group in RMON MIB):
  The system continuously collects traffic statistics and distribution of each type of packets on a network segment. The system also counts the number of:

  • Network collisions
  • CRC error packets
  • Undersized or large packets
  • Broadcast and multicast packets
  • Bytes received
  • Packets received
• History statistics (history group in RMON MIB):
  The system periodically collects statistics on each type of traffic, including

  • Bandwidth usage
  • Error packets
  • Total number of packets

RMON uses the event group to provide event definition, and the alarm group to provide alarm threshold setting.

• Event definition (event group in RMON MIB):

  Controls the events and notifications sent from the device and provides all events related to RMON agent. When an event occurs, the system records a log or sends a trap to the NMS.

• Alarm threshold setting (alarm group in RMON MIB):

  Monitors the specified alarm variables (object ID). Based on the user-defined thresholds and sampling time, the system periodically obtains the specified alarm variables. When the values of the alarm variables reach or exceed the rising threshold, a rising threshold alarm event is triggered. When the values of the alarm variables reach or fall below the falling threshold, a falling threshold alarm event is triggered. The RMON agent logs the monitored status or sends a trap to the NMS.

RMON Groups

RMON standard (RFC 2819) defines multiple RMON groups. The switch supports the Huawei-defined extended alarm, statistics, history, alarm, and event groups. Details of these groups are as follows:

• Statistics group

  Continuously collects statistics on all traffic on Ethernet interfaces and records statistics results in the etherStatsTable. Traffic statistics include:

  • Network collisions
  • CRC error packets
  • Undersized or large data packets
  • Broadcast and multicast packets
  • Bytes received
  • Total packets received

  After a statistics entry is created on an interface, the statistics group starts collecting and accumulating statistics on the packets.

• History group

  Periodically collects network status statistics and stores them.

  The history group provides two tables:

  • historyControlTable

    Sets control information such as the sampling interval.

  • etherHistoryTable

    Stores network statistics collected by the history group. It also provides the network administrator with history statistics such as the traffic on a network segment, error packets, broadcast packets, bandwidth usage, and collisions.

• Event group

  The defined events are used for the configuration options of the alarm group and extended alarm group. When alarm conditions are met, an event is triggered. RMON event management adds events to the specified rows in the event table. The following options are supported:

  • log: only send log.

  • trap: only send trap to the NMS.

  • log-trap: send both log and trap.

  • none: take no action.

• Alarm group

  This group presets a set of thresholds for alarm variables, which can be objects in a local MIB. Based on the user-defined alarmTable, the system periodically obtains the specified alarm variables. When the values of the alarm variables reach or exceed the rising threshold, a rising threshold alarm event is triggered. When the values of the alarm variables reach or fall below the falling threshold, the system takes an action according to the action configuration.

• Extended alarm group

  Based on RFC 2819, the extended alarm group has the new function of using expressions to set the alarm object and keepalive time. This group provides the prialarmTable. Compared with the alarm table defined in RFC 2819, the extended alarm table has the following new options:

  • Extended alarm variable expression. This is an arithmetic expression composed of alarm variables OIDs (+, -, *, /, or brackets).

  • Descriptions of extended alarm entries.

  • Sampling interval variables.

  • Extended alarm types. Forever or Cycle. If Cycle is set, no alarm is generated and the entry is deleted after the specified cycle period expires.

Each entry has a lifetime. When an entry's status is not valid, the entry exists for a certain period before it is deleted. The entry is deleted when its lifetime decreases to 0. Table 1 shows the capacity of each table and the maximum lifetime of an entry in each table.

Each entry in the historyControlTable corresponds to a maximum of 10 history records in the etherHistoryTable. When more than 10 records are generated, the old ones are overwritten.

No maximum lifetime is specified for the entries in logTable. Each event entry in logTable corresponds to up to 10 logs. When more than 10 logs are generated, the old ones are overwritten.

RMON2

A switch provides two RMON2 MIB groups: protocolDir and nlHost. The RMON agent collects statistics on IP packets. This agent supports three tables: protocolDirTable, hostTable, and hostControlTable.

The hostTable uses customized indexes to invoke the protocolDirTable and hostControlTable. The hostTable does not need to be configured before configuring the RMON2 traffic statistics function. After the protocolDirTable and hostControlTable are configured, the hostTable automatically collects traffic statistics.

• protocolDirTable

  Lists the protocols that the RMON agent resolves and collects statistics on. The protocols include network-layer, transport-layer, and upper-layer protocols. Each protocol occupies a row.

• hostTable

  Collects traffic statistics on each host and analyzes incoming and outgoing data packets on interfaces, based on IP addresses.

• hostControlTable

  Defines the statistics monitoring interface and records the number of frames received by the interface. These are not recorded into the nlHost table. It is classified into network-layer hostControlTable and application-layer hostControlTable. This table also records the number of times entries are added and deleted, and the maximum number of entries in nlHostTable.

The switch supports only network-layer hostControlTable, so it does not control application-layer host groups. Therefore, only IP protocols can be configured in the protocolDirTable.