The Simple Network Management Protocol (SNMP) is a widely used network management protocol that collects network communication statistics using agent software embedded in managed devices. The management software obtains network management data by sending query signals to the Agent Management Information Base (MIB) in polling mode. Although the MIB counter records data statistics, it cannot analyze data historically. The NMS software continuously queries the managed devices for data in polling mode, which is then used to build an overall picture of network traffic and traffic changes, in order to analyze overall network status.
Two obvious shortcomings of SNMP polling are as follows:
To provide more valuable management information, lighten the NMS workload, and allow the network administrator to monitor multiple network segments, the Internet Engineering Task Force (IETF) developed RMON for monitoring data traffic on a network segment or across an entire network.
Ethernet statistics (corresponding to the statistics group in RMON MIB): The system collects the basic statistics of monitored networks. The system continuously collects statistics of traffic and various packets distribution on a network segment, or the number of various error frames and collisions. The statistics include network collisions, CRC error packets, the number of oversize or undersize packets, the number of broadcast or multicast packets, and the number of received bytes or packets.
Historical sampling function (corresponding to the history group in RMON MIB): The system periodically samples network statuses and stores the information for later queries. The system also periodically samples port traffic data, specifically bandwidth usage, the number of error packets, and the number of total packets.
The function to process an event as recording a log or sending trap messages (corresponding to the event group in RMON MIB): The event group controls the events and prompts, and provides all the events generated by the RMON Agent. A log is generated or trap messages are sent to the NMS for notifying an occurred event.
Alarm threshold (corresponding to the alarm group in RMON MIB): The system monitors the objects of a specific alarm type, and a sampled value can be either an absolute value or a difference in values. Once an alarm's upper and lower thresholds are defined, the system will sample at a pre-defined interval. Sampled values above the upper threshold trigger a rising alarm and sampled values below the threshold trigger a falling alarm. The NMS processes them based on the definitions of the events. RMON Agent either records the information as a log or sends trap messages to the NMS.
RMON brings the following benefits for users: