RmonRmon

Diagram of RMON MIBDiagram of RMON MIBRoot

ISO Org

DoD

InternetMgmt

MIB 1 & 2

RMON

MIB 1

MIB 2

Private

1. Statistics

9. Event

7. Filter

8. Capture

6. Matrix

5. Host Top N

4. Hosts

3. Alarm 2. History

10. Token Ring

RMON MIB GroupsRMON MIB Groups

Statistics - Traffic and error rates on a segmentStatistics - Traffic and error rates on a segmentHistory - Above statistics with a time stamp History - Above statistics with a time stamp Alarm - User defined threshold alarms on any RMON variableAlarm - User defined threshold alarms on any RMON variableHosts - Traffic and error rates for each host by MAC address Hosts - Traffic and error rates for each host by MAC address Host Top N - Sorts hosts by top traffic and/or error rates Host Top N - Sorts hosts by top traffic and/or error rates Matrix - Conversation matrix between hostsMatrix - Conversation matrix between hostsFilter - Definition of what packet types to capture and store Filter - Definition of what packet types to capture and store Packet Capture - Creates a capture buffer on the probe that Packet Capture - Creates a capture buffer on the probe that

can be requested and decoded by the management applicationcan be requested and decoded by the management applicationEvent - Generates log entries and/or SNMP traps Event - Generates log entries and/or SNMP traps Token Ring - Token Ring extensions, most complex groupToken Ring - Token Ring extensions, most complex group

RMON Increases Management Capacity to 250% RMON Increases Management Capacity to 250% Distributed Techniques Save Time and MoneyDistributed Techniques Save Time and Money

Source: McConnell Consulting, Inc. 9/94 Survey of LAN Managers

0 5 10 15 20 25 30

11 to 50

51 to 100

101 to 200

200+

segments

segments managed per staff person

RMON No RMON

Using RMON, Network Management Staff Can Using RMON, Network Management Staff Can Provide Services to More Users and SegmentsProvide Services to More Users and Segments

Network Manager Needs More HelpNetwork Manager Needs More HelpClient / Server Revolution is HereClient / Server Revolution is Here

• Mission critical client/server applications mean that Mission critical client/server applications mean that network up-time and performance are network up-time and performance are requiredrequired

• Good information currently available for segment traffic, Good information currently available for segment traffic, performance and utilization (RMON1)performance and utilization (RMON1)

• End-to-end, global view of enterprise traffic is needed for End-to-end, global view of enterprise traffic is needed for troubleshooting today’s complex internetwork(RMON2)troubleshooting today’s complex internetwork(RMON2)

– Isolate cause of problem quickly and respondIsolate cause of problem quickly and respond

– Redeploy resources for optimal performanceRedeploy resources for optimal performance

– Spot bandwidth utilization trends before Spot bandwidth utilization trends before bottlenecks occurbottlenecks occur

Remote Monitoring in the ISO ModelRemote Monitoring in the ISO ModelGoing Up-the-stack With RMON2 Going Up-the-stack With RMON2

RMONRMON

RMON2RMON2

PhysicalPhysical

Data LinkData Link

NetworkNetwork

TransportTransport

ApplicationApplication

SessionSession

PresentationPresentation

Enterprise Network Traffic ManagementEnterprise Network Traffic ManagementBenefits of Monitoring Protocols “Up-the-stack”Benefits of Monitoring Protocols “Up-the-stack”

• Understand network performance from Understand network performance from an application perspectivean application perspective

• Logical view of workgroup and application Logical view of workgroup and application communication patternscommunication patterns

• Clear visualization of end-to-end traffic Clear visualization of end-to-end traffic

• High-value enterprise traffic information results:High-value enterprise traffic information results:– Improved performance through network tuning Improved performance through network tuning

and optimal placement of network resourcesand optimal placement of network resources– Trend analysis based on actual growth ratesTrend analysis based on actual growth rates– Accurate accounting dataAccurate accounting data

IETF Responds: RMON2 Standard IETF Responds: RMON2 Standard for Monitoring Higher Protocol Layersfor Monitoring Higher Protocol Layers

• RMON (1) accepted and implementedRMON (1) accepted and implemented

• RMON2 Working Group kicked off July 1994RMON2 Working Group kicked off July 1994

• RMON2 Internet Draft delivered June 1995RMON2 Internet Draft delivered June 1995

• First RMON2 interoperability testing occurred First RMON2 interoperability testing occurred in September 1996in September 1996

• RMON2 received its RFC #s (2021, 2074) RMON2 received its RFC #s (2021, 2074) in January 1997in January 1997

• Vendors can commence development of RMON2-compliant Vendors can commence development of RMON2-compliant implementations immediatelyimplementations immediately

What is RMON2? Standard for What is RMON2? Standard for Monitoring Higher Protocol LayersMonitoring Higher Protocol Layers

• Major new capability: Provide statistics Major new capability: Provide statistics on network-and application-layer trafficon network-and application-layer traffic– Open structure for collecting traffic data Open structure for collecting traffic data

at higher protocol layersat higher protocol layers– Protocol directory critical aspect of the MIBProtocol directory critical aspect of the MIB

• Additional enhancements:Additional enhancements:– Address TranslationAddress Translation– User-defined historiesUser-defined histories– Probe configuration-device, modem and trap administration Probe configuration-device, modem and trap administration

based on the Aspen MIBbased on the Aspen MIB– Time sorted tablesTime sorted tables

Diagram of the RMON2 MIBDiagram of the RMON2 MIB

MIB 1&2

MIB 1

MIB 2

Root

ISO OrgDoD

InternetMgmt Private

RMON1

1. Statistics

9. Event

7. Filter

8. Capture

6. Matrix

5. Host Top N

4. Hosts

3. Alarm 2. History

10. Token Ring

RMON2

11. Protocol Directory

19. Probe Configuration

17. Application-Layer Matrix

18. User History

16. Application-Layer Host

15. Network-Layer Matrix

14. Network-Layer Host

13. Address Map12. Protocol Distribution

20. RMON Conformance

RMON

RMON2 MIB GroupsRMON2 MIB GroupsProtocol Directory - List of protocols the probe can monitorProtocol Directory - List of protocols the probe can monitor

Protocol Distribution - Traffic statistics for each protocolProtocol Distribution - Traffic statistics for each protocol

Address Map - Maps network-layer to MAC-layer addresses Address Map - Maps network-layer to MAC-layer addresses

Network-Layer Host - Traffic statistics to and from each discovered hostNetwork-Layer Host - Traffic statistics to and from each discovered host

Network-Layer Matrix - Traffic statistics on conversations between pairs Network-Layer Matrix - Traffic statistics on conversations between pairs of discovered hosts of discovered hosts

Application-Layer Host - Traffic statistics to and from each host by Application-Layer Host - Traffic statistics to and from each host by protocol providing insight into the use and growth of applicationsprotocol providing insight into the use and growth of applications

Application-Layer Matrix - Traffic statistics on conversations between Application-Layer Matrix - Traffic statistics on conversations between pairs of hosts by protocol pairs of hosts by protocol

User History Collection - Periodic samples of user-specified variablesUser History Collection - Periodic samples of user-specified variables

Probe Configuration - Remote configuration of probe parameters Probe Configuration - Remote configuration of probe parameters

RMON Conformance - Requirements for RMON2 MIB conformanceRMON Conformance - Requirements for RMON2 MIB conformance20

19

18

17

16

15

14

13

12

11

RMON2 Implementation Options Two Alternatives RMON2 Implementation Options Two Alternatives Balancing Price and PerformanceBalancing Price and Performance

• ““Type BType B” Implementations” Implementations– Application layer trafficApplication layer traffic– More memory and More memory and

processor powerprocessor power– Basis for high-end traffic Basis for high-end traffic

management applicationsmanagement applications

• ““Type AType A” Implementations” Implementations– Network layer trafficNetwork layer traffic– Less memory and Less memory and

processor powerprocessor power– Expect to see embedded Expect to see embedded

in hubs and switchesin hubs and switches

Network LayerNetwork Layer Application LayerApplication Layer

StatisticsStatistics XX XX

HostsHosts XX XX

MatrixMatrix XX XX

Matrix topNMatrix topN XX XX

Impact of RMON2: Adding a Logical View Impact of RMON2: Adding a Logical View to Management Productsto Management Products

• Answers critical questions like:Answers critical questions like:– What percent of WAN traffic is due to my What percent of WAN traffic is due to my

order-entry application?order-entry application?– How fast is the Lotus Notes traffic growing?How fast is the Lotus Notes traffic growing?– How many hours does Fred spend on the web?How many hours does Fred spend on the web?

• Requires new user-interfaceRequires new user-interface– Scaleable, end-to-end view of all traffic on networkScaleable, end-to-end view of all traffic on network– Support range of logical groupingsSupport range of logical groupings– Linked to other management applications Linked to other management applications

• Essential for roll-out of client/server applicationsEssential for roll-out of client/server applications

Example RMON2 Solution: TranscendExample RMON2 Solution: Transcend®® Traf Traffixfix™ ™ Manager and SuperStack® II Enterprise MonitorManager and SuperStack® II Enterprise Monitor

Tuning the Network to the BusinessTuning the Network to the Business

• Comprehensive understanding of network trafficComprehensive understanding of network traffic– Real-time and historicalReal-time and historical– Applications and protocolsApplications and protocols– Utilizing RMON2 dataUtilizing RMON2 data

• Optimize the network to meet the needs Optimize the network to meet the needs of business applications of business applications

• Speed troubleshooting at the enterprise network Speed troubleshooting at the enterprise network level, rather than the device or segment levellevel, rather than the device or segment level

• Set real policies for the business use Set real policies for the business use of the networkof the network

System-level Management of Networked System-level Management of Networked AppsApps

• Top down view of all traffic on networkTop down view of all traffic on network– End-to-end display of conversationsEnd-to-end display of conversations– Network-and application-layer traffic detailsNetwork-and application-layer traffic details– Designed and tested to scale to large, complex networksDesigned and tested to scale to large, complex networks

• Powerful, alternative logical groupingsPowerful, alternative logical groupings– Much more than “Protocol Domains” Much more than “Protocol Domains” – Group by geography, function, subnet, VLAN, etc.Group by geography, function, subnet, VLAN, etc.– Easy-to-use navigationEasy-to-use navigation

• Speeds troubleshooting Speeds troubleshooting – Global view to see interaction and scopeGlobal view to see interaction and scope– Zoom to problem hosts, devices, protocolsZoom to problem hosts, devices, protocols– Launch detailed protocol analysis on any linkLaunch detailed protocol analysis on any link

Communicate to Users and ManagementCommunicate to Users and Management

• Fully integrated traffic databaseFully integrated traffic database– Real-time and historical information in all viewsReal-time and historical information in all views– Histories over the past day, week, month, Histories over the past day, week, month,

year, etc.year, etc.– Trend analysis, comparison and graphing Trend analysis, comparison and graphing – Set thresholds on key parametersSet thresholds on key parameters

• Automated reporting Automated reporting – Key trends in application, network Key trends in application, network

and device utilizationand device utilization– Easy report set-up from same view as GUIEasy report set-up from same view as GUI– Built-in, no data export/import requiredBuilt-in, no data export/import required

Traffic Management is a New DisciplineTraffic Management is a New DisciplineBusiness ApplicationsBusiness ApplicationsTrafficTrafficInfrastructureInfrastructure

• Brings together:Brings together:– Application level monitoringApplication level monitoring– Enterprise-wide instrumentationEnterprise-wide instrumentation– Ubiquitous standardUbiquitous standard

• To achieve:To achieve:– Analysis of applications’ use of infrastructureAnalysis of applications’ use of infrastructure– Performance management as seen by usersPerformance management as seen by users– Tuning, capacity planning, accounting, etc. based Tuning, capacity planning, accounting, etc. based

on business applications usageon business applications usage– System level troubleshootingSystem level troubleshooting

• In the face of:In the face of:– New network technologies (VLANs)New network technologies (VLANs)– Unpredictable traffic trends Unpredictable traffic trends

Mission: Enterprise Traffic ManagementMission: Enterprise Traffic ManagementBuild on Foundation of Infrastructure ManagementBuild on Foundation of Infrastructure Management

Tuning and PlanningTuning and PlanningTroubleshootingTroubleshooting

BusinessBusinessObjectivesObjectives

PoliciesPolicies

Infrastructure ManagementInfrastructure Management

Quality of ServiceQuality of Service

Traffic ManagementTraffic Management

EfficiencyEfficiency

Survival!Survival!

MIB

2M

IB 2

RM

ON

1R

MO

N1

RM

ON

2R

MO

N2

Advantages: Enterprise Traffic ManagementAdvantages: Enterprise Traffic ManagementNew Level of Network Knowledge and CapabilitiesNew Level of Network Knowledge and Capabilities

Infrastructure ManagementInfrastructure Management Traffic ManagementTraffic ManagementActivityActivity

Concepts andConcepts andPerspectivePerspective

TroubleTroubleshootingshooting

PlanningPlanningTuningTuning

PoliciesPolicies

Physical - devices andPhysical - devices andsegmentssegments

Device control andDevice control andconfigurationconfigurationPhysical connectivityPhysical connectivity

See effects on devicesSee effects on devices““Purchase Order” planningPurchase Order” planningLocal utilization and rate ofLocal utilization and rate ofgrowth at packet levelgrowth at packet levelStandardize equipmentStandardize equipmentpurchasepurchase

Logical - traffic and applicationsLogical - traffic and applicationsReflects Reflects organizationorganization, scope, scope

groupsgroupsBehavior of whole networkBehavior of whole networkDiscriminate between applicationDiscriminate between applicationproblems and network problemsproblems and network problems

See causes, as well as effectsSee causes, as well as effectsBusiness planning based on realBusiness planning based on realutilization and rate of growthutilization and rate of growth

applicationsapplications

Define “reasonable” useDefine “reasonable” useSet use policies and enforce themSet use policies and enforce them

andand

ofof

Results: Enterprise Traffic Management Results: Enterprise Traffic Management Improved Responses to Performance ProblemsImproved Responses to Performance Problems

Hours / MinutesHours / Minutes

Add Add ResourcesResources

ReconfigureReconfigureResourcesResources

TrafficTrafficPolicyPolicy

Days / WeeksDays / Weeks

MonthMonth

YearYearTrend/Report for Re-Design Trend/Report for Re-Design

and Adding Resourcesand Adding Resources

Performance Assessment Performance Assessment for Tuning and Optimizationfor Tuning and Optimization

Prioritize Network Use Prioritize Network Use to Business Needsto Business Needs

Benefits: Enterprise Traffic ManagementBenefits: Enterprise Traffic ManagementMatch Network Investments to Business ObjectivesMatch Network Investments to Business Objectives

– Improve network performance, eliminate bottlenecks, Improve network performance, eliminate bottlenecks, so business applications run faster, more reliablyso business applications run faster, more reliably

– Find enterprise network system problems fastFind enterprise network system problems fast

– Only invest due to business application growth Only invest due to business application growth – Don’t waste expensive network resource Don’t waste expensive network resource

on “chat” trafficon “chat” traffic

– Efficient distributed techniques bring the problem Efficient distributed techniques bring the problem to the expert, rather than the expert to the problemto the expert, rather than the expert to the problem

– Ease-of-use means information can be handled Ease-of-use means information can be handled by less skilled staff membersby less skilled staff members

$