Configuring RMON Support
ErrorMessage : Error while constructing the Hinav

null
Downloads: This chapterpdf (PDF - 165.0KB) | Feedback

Configuring RMON Support

Table Of Contents

Configuring RMON Support

Configuring RMON Support

Configuring RMON Alarm and Event Notifications

Configuring RMON Groups

Monitoring and Verifying RMON Configuration

RMON Configuration Examples

Alarm and Event Example

show rmon Command Example


Configuring RMON Support


This chapter describes the Remote Monitoring (RMON) MIB agent specification, and how it can be used in conjunction with Simple Network Management Protocol (SNMP) to monitor traffic using alarms and events.

For a complete description of the RMON commands mentioned in this chapter, refer to the "RMON Commands" chapter in the "System Management" part of the Release 12.2 Cisco IOS Configuration Fundamentals Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.

Configuring RMON Support

The RMON option identifies activity on individual nodes and allows you to monitor all nodes and their interaction on a LAN segment. Used in conjunction with the SNMP agent in a router, RMON allows you to view both traffic that flows through the router and segment traffic not necessarily destined for the router. Combining RMON alarms and events (classes of messages that indicate traffic violations and various unusual occurrences over a network) with existing MIBs allows you to choose where proactive monitoring will occur.


Note Full RMON packet analysis (as described in RFC 1757) is supported only on an Ethernet interface of Cisco 2500 series routers and Cisco AS5200 series universal access servers. RMON requires that SNMP be configured (you must be running a version of SNMP on the server that contains the RMON MIB). A generic RMON console application is recommended in order to take advantage of the RMON network management capabilities. This feature supports RFCs 1757 and 2021.


RMON can be very data- and processor-intensive. Users should measure usage effects to ensure that router performance is not degraded by RMON and to minimize excessive management traffic overhead. Native mode in RMON is less intensive than promiscuous mode.

All Cisco IOS software images ordered without the explicit RMON option include limited RMON support (RMON alarms and event groups only). Images ordered with the RMON option include support for all nine management groups (statistics, history, alarms, hosts, hostTopN, matrix, filter, capture, and event). As a security precaution, support for the capture group allows capture of packet header information only; data payloads are not captured.

In Cisco IOS 12.1, the RMON agent was rewritten to improve performance and add some new features. Table 23 highlights some of the improvements implemented.

Table 23 RMON MIB Updates

Prior to the RMON MIB Update in Cisco IOS Release 12.1
New functionality in Cisco IOS Release 12.1

RMON configurations do not persist across reboots. Information is lost after a new session on the RMON server.

RMON configurations persist across reboots. Information is preserved after a new session on the RMON server.

Packet analysis applies only on the MAC header of the packet.

Complete packet capture is performed with analysis applied to all frames in packet.

Only RMON I MIB objects are used for network monitoring.

RMON I and selected RMON II objects are used for network monitoring.


RMON MIB features include the following:

usrHistory group. This MIB group is similar to the RMON etherHistory group except that the group enables the user to specify the MIB objects that are collected at each interval.

partial probeConfig group. This MIB group is a subset of the probeConfig group implemented in read-only mode. These objects implement the simple scalars from this group. Table 24 details new partial probeConfig group objects.

Table 24 partial probeConfig Group Objects 

Object
Description

probeCapabilities

The RMON software groups implemented.

probeSoftwareRev

The current version of Cisco IOS running on the device.

probeHardwareRev

The current version of the Cisco device.

probeDateTime

The current date and time.

probeResetControl

Initiates a reset.

probeDownloadFile

The source of the image running on the device.

probeDownloadTFTPServer

The address of the server that contains the Trivial File Transfer Protocol (TFTP) file that is used by the device to download new versions of Cisco IOS software.

probeDownloadAction

Specifies the action of the commands that cause the device to reboot.

probeDownloadStatus

The state of a reboot.

netDefaultGateway

The router mapped to the device as the default gateway.

hcRMONCapabilities

Specifies the features mapped to this version of RMON.


Configuring RMON Alarm and Event Notifications

To enable RMON on an Ethernet interface, use the following command in interface configuration mode:

Command
Purpose

Router(config-if)# rmon {native | promiscuous}

Enables RMON.


In native mode, RMON monitors only the packets normally received by the interface. In promiscuous mode, RMON monitors all packets on the LAN segment.

The default size of the queue that holds packets for analysis by the RMON process is 64 packets. To change the size of the queue, use the following command in global configuration mode:

Command
Purpose

Router(config)# rmon queuesize size

Changes the size of the RMON queue.


To set an RMON alarm or event, us the following commands in global configuration mode, as needed:

Command
Purpose

Router(config)# rmon alarm number variable interval {delta | absolute} rising-threshold value [event-number] falling-threshold value [event-number] [owner string]

Sets an alarm on a MIB object.

Router(config)# rmon event number [log] [trap community] [description string] [owner string]

Adds or removes an event in the RMON event table.


You can set an alarm on any MIB object in the access server. To disable an alarm, you must enable the no form of this command on each alarm you configure. You cannot disable all the alarms you configure at once. Refer to RFC 1757 to learn more about alarms and events and how they interact with each other.

The RMON MIB defines two traps, the risingAlarm and fallingAlarm traps generated when an RMON alarmEntry risingThreshold or fallingThreshold event occurs. Thresholds allow you to minimize the number of notifications sent on the network. Alarms are triggered when a problem exceeds a set rising threshold value. No more alarm notifications are sent until the agent recovers, as defined by the falling threshold value. This means that notifications are not sent each time a minor failure or recovery occurs.

Configuring RMON Groups

RMON tables can be created for buffer capture, filter, hosts, and matrix information. The buffer capture table details a list of packets captured off a channel or a logical data or events stream. The filter table details a list of packet filter entries that screen packets for specified conditions as they travel between interfaces. The hosts table details a list of host entries. The matrix table details a list of traffic matrix entries indexed by source and destination MAC addresses.

To gather RMON statistics for these data types, use the following commands in interface configuration mode, as needed:

Command
Purpose

Router(config-if)# rmon collection history {controlEntry integer} [owner ownername] [buckets bucket-number] [interval seconds]

Enables an RMON history group of statistics on an interface.

Router(config-if)# rmon collection host {controlEntry integer} [owner ownername]

Enables an RMON host collection group of statistics on an interface.

Router(config-if)# rmon collection matrix {controlEntry integer} [owner ownername]

Enables an RMON matrix group of statistics on an interface.

Router(config-if)# rmon collection rmon1 {controlEntry integer} [owner ownername]

Enables all possible autoconfigurable RMON statistic collections on an interface.


To specifically monitor these commands, use the show rmon capture, show rmon filter, show rmon hosts, and show rmon matrix EXEC commands listed in the following table.

Monitoring and Verifying RMON Configuration

To display the current RMON status, use one or more of the following commands in EXEC mode:

Command
Function
Router> show rmon

or

Router> show rmon task

Displays general RMON statistics.

Router> show rmon alarms

Displays the RMON alarm table.

Router> show rmon capture

Displays the RMON buffer capture table and current configuration. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.

Router> show rmon events

Displays the RMON event table.

Router> show rmon filter

Displays the RMON filter table. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.

Router> show rmon history

Displays the RMON history table. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.

Router> show rmon hosts

Displays the RMON hosts table. Available only on Cisco 2500 series routers and Cisco AS5200 access serverss.

Router> show rmon matrix

Display the RMON matrix table and values associated with RMON variables. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.

Router> show rmon statistics

Display the RMON statistics table. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.

Router> show rmon topn

Display the RMON top-n hosts table. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.


RMON Configuration Examples

This section provides the following examples:

Alarm and Event Example

show rmon Command Example

Alarm and Event Example

The following example enables the rmon event global configuration command:

Router(config)# rmon event 1 log trap eventtrap description "High ifOutErrors" owner 
owner_a

This example creates RMON event number 1, which is defined as "High ifOutErrors", and generates a log entry when the event is triggered by an alarm. The user "owner_a" owns the row that is created in the event table by this command. This example also generates an SNMP trap when the event is triggered.

The following example configures an RMON alarm using the rmon alarm global configuration command:

Router(config)# rmon alarm 10 ifEntry.20.1 20 delta rising-threshold 15 1 
falling-threshold 0 owner owner_a

This example configures RMON alarm number 10. The alarm monitors the MIB variable ifEntry.20.1 once every 20 seconds until the alarm is disabled, and checks the change in the rise or fall of the variable. If the ifEntry.20.1 value shows a MIB counter increase of 15 or more, such as from 100000 to 100015, the alarm is triggered. The alarm in turn triggers event number 1, which is configured with the rmon event command. Possible events include a log entry or an SNMP trap. If the ifEntry.20.1 value changes by 0, the alarm is reset and can be triggered again.

show rmon Command Example

To display the RMON buffer capture table and current configuration, enter the show rmon capture EXEC command (Cisco 2500 series routers and Cisco AS5200 access servers only). A sample configuration follows:

Router# show rmon capture

Buffer 1 is active, owned by John Smith
Captured data is from channel 1
Slice size is 128, download size is 128
Download offset is 0
Full Status is full, full action is wrapWhenFull
Granted -1 octets out of -1 requested
Buffer has been on since 18:59:48, and has captured 522 packets
Current capture buffer entries:
Packet 3271 was captured 2018256 ms since buffer was turned on
Its length is 184 octets and has a status type of 0
Packet ID is 3721, and contains the following data:
03 00 	00 00 	00 01	00 A0	CC 3C	9D DF	00 A6	F0 03
Packet 3722 was captured 2018452 ms since buffer was turned on
Its length is 64 octets and has a status type of 0
Packet ID is 3722, and contains the following data:
01 80	C2 00	00 00	00 60	09 FD	FE D3	00 26	42 03

To view values associated with RMON variables, enter the show rmon matrix EXEC command (Cisco 2500 series routers and Cisco AS5200 access servers only). The following is a sample output:

Router# show rmon matrix

Matrix 1 is active and owned by 
Monitors ifEntry.1.1
Table size is 42, last time an entry was deleted was at 11:18:09
Source addr is 0000.0c47.007b, dest addr is ffff.ffff.ffff
Transmitted 2 pkts, 128 octets, 0 errors
Source addr is 0000.92a8.319e, dest addr is 0060.5c86.5b82
Transmitted 2 pkts, 384 octets, 1 error

For an explanation of the fields in the examples, refer to the respective command descriptions in the "RMON Commands" chapter of the Release 12.2 Cisco IOS Configuration Fundamentals Command Reference.