The recently announced software enhancements to the Catalyst(tm) workgroup switch make it the industry's first LAN switch to support embedded Remote Monitoring Specification (RMON) monitoring software. Cisco has partnered with Frontier Software to produce the industry's most advanced traffic analysis and troubleshooting capabilities for switched networks in this newest release (3.0) of Catalyst. With its embedded RMON software, Catalyst now provides network administrators enhanced visibility of their switched network traffic and offers them more powerful and cost-effective ways to troubleshoot and tune switched network performance.
Complementing Catalyst's enhanced monitoring capabilities is NETScout Manager, a graphical user interface (GUI)-based RMON console manager. Its powerful RMON filtering and monitoring functions help network administrators manage the complex information available from the RMON Management Information Base (MIB). A collection of tools provides extensive graphing, alarm, logging, and reporting capabilities.
Over time, the user community with the help of the Internet Engineering Task Force (IETF) defined a standard monitoring specification that allows various network monitors and console systems to exchange network monitoring data. This RMON specification defines a set of statistics and functions that can be exchanged between RMON-compliant console managers and network probes. RMON offers network administrators more freedom in selecting network monitoring probes and consoles whose features meet their particular networking needs.
A basic RMON system can provide such data as:
Most RMON providers implement enough of the RMON specification (usually the first seven groups) to support these data link and traffic flow analysis functions.
A fully instrumented RMON probe offers additional packet capture capabilities that allow it to be used as a data collection mechanism for more extensive network analysis and accounting applications. RMON groups eight and nine deliver the information needed to support sophisticated protocol analyzer and network accounting functions such as:
As seen in the following diagram, as switch usage grows, the cost of maintaining the same level of network visibility can also grow at a geometric pace.
For this reason switch vendors are offering different methods of simultaneously providing full network traffic visibility and minimizing cost. One approach is to copy traffic from a selected segment of the LAN switch to a port attached to a network analyzer. This port-monitoring function helps recoup visibility within a switched network but has a few drawbacks. First, the remote monitor may not accurately collect certain data-link statistics (errors, giants, and runts for example) because the switch may filter these events before they are passed to the network analyzer. Another drawback is that the remote monitoring tool can still monitor only one LAN segment at a time. This could create difficulties for a network administrator who is trying to diagnose a problem that spans multiple segments of the LAN switch.
Cisco offers a unique solution by integrating monitoring functions into its LAN switching platform. Because of the Catalyst switch's multiprocessor design (one processor dedicated exclusively for management), it can simultaneously perform as both a LAN switch and a multisegment RMON network probe.
To provide both network monitoring and switching performance optimally, Catalyst can be configured to collect network traffic data in two ways. In standard RMON mode, Catalyst can collect and forward comprehensive network traffic information from multiple Ethernet segments simultaneously. This allows the network administrator to obtain all the information necessary to help tune or troubleshoot a switched LAN. The benefit of concurrently collecting multiple traffic feeds is obvious for network administrators who attach workgroup servers to dedicated Ethernet segments to improve network performance. If network administrators need to troubleshoot client/server applications, the task is greatly simplified through Catalyst's ability to simultaneously record traffic from both the server's and the client's segments.
Catalyst supports a secondary monitoring mode that provides more focused coverage across all of its eight switched Ethernet segments. Called "Roving RMON," this mode allows the network administrator to monitor either of two RMON groups across all eight Catalyst Ethernet segments. Roving RMON can be used to collect historical network traffic data (like total switched data including packets, octets, and errors) per port or even per station. The network manager can use this data for various tasks such as capacity planning analysis or network accounting and billing.
Catalyst's Roving RMON also has a unique, user-definable trap feature that lets it reconfigure itself in case it detects specific network events. Network administrators can preconfigure the Catalyst to look out for potentially threatening conditions such as excessive collisions, corrupted packets, or even excessive traffic from a specific station. If the switch detects one of these predefined conditions, it sends an alert (trap) to the network management console and simultaneously initializes a fully configured RMON probe to monitor traffic on the offending network segment. With this function, network administrators can detect and collect troubleshooting data automatically, thereby extending their management capability while also helping to recognize and rectify network problems before they affect users.
To help network administrators track and troubleshoot protocol-related network problems, both the RMON probe and the console should also provide the tools to automatically capture network packet data for offline analysis. The console manager should let the network administrator limit packet captures by using predefined or user-defined filters to help tailor the RMON probe functionality to meet specific troubleshooting needs.
These tools allow the administrator to monitor traffic, set thresholds, and capture data on any set of network traffic for any segment. They collect information about all nine RMON groups to isolate and determine problem conditions on the network.
NETScout is available on a variety of platforms including SunNet Manager, HP OpenView, IBM NetView 6000, and PC Windows. NETScout Manager can run as a complementary application to Cisco's network management applications (CiscoWorks(tm), Workgroup Director(tm)), third-party network management applications (SunNet Manager, HP OpenView), or as a standalone application.
RMON Monitor and Console Buying Criteria ----------------------------------------------------------------------------- FEATURE CISCO SYSTEMS CATALYST ============================================================================= RMON ProbeInstrumentation of all nine RMON groups Yes (including packet capture and filtering)
RMON functionality without compromising Yes switching performance
Simultaneously collect full RMON information Four-segment capture for multiple segments without degradation
Means of monitoring all switched segments Roving RMON simultaneously
RMON Console
Easy-to-use, GUI-based interface Yes
Preconfigured, user-definable filters for Yes RMON data collection
Automated RMON console alarms Yes
Semi-automated packet data capture Yes
GUI-based protocol decode capability Yes for 14 protocols
Graphing functions for network trend analysis Yes
Network usage reporting functions Yes
RMON console across a variety of Yes; Sun, HP 9000/700, IBM management platforms RS/6000, and PC Windows -----------------------------------------------------------------------------
-----------------------------------------------------------------------------
RMON GROUP FUNCTION ELEMENTS
=============================================================================
Statistics Contains statistics measured Packets dropped, packets sent,
Group by the probe for each monitored bytes sent (octets), broadcast
interface on this device. packets, multicast packets,
CRC errors, runts, giants,
fragments, jabbers,
collisions, and counters for
packets ranging from 64-128,
128-256, 256-512, 512-1024,
and 1024-1518 bytes in size.
-----------------------------------------------------------------------------
History Records periodic statistical Sample period, number of
Group samples from a network and samples, item(s) sampled.
stores them for later retrieval.
-----------------------------------------------------------------------------
Alarm Periodically takes statistical Alarm type, interval, starting
Group samples from variables in the threshold, stop threshold.
probe and compares them with
previously configured
thresholds. If the monitored
variable crosses a threshold,
an event is generated. A
hysteresis mechanism is
implemented to limit the
generation of alarms. This
group includes the "alarmTable"
and requires the implementation
of the "event" group.
-----------------------------------------------------------------------------
Host Contains statistics associated Host address, packets and
Group with each host discovered on bytes received & transmitted,
the network. tas well as broadcast,
multicast, and error packets.
-----------------------------------------------------------------------------
HostTopN Prepares tables that describe Statistics, which host(s),
Group the hosts that top a list sample start and stop period,
ordered by one of their rate base, duration.
statistics. The available
statistics are samples of one
of their base statistics over
an interval specified by the
management station. Thus, these
statistics are rate based.
-----------------------------------------------------------------------------
Matrix Stores statistics for Source and destination address
Group conversations between sets of pairs and packets, bytes, and
two addresses. As the device errors for each pair.
detects a new conversation, it
creates a new entry in its
tables.
-----------------------------------------------------------------------------
Filter Allows packets to be matched by Bit filter type (mask or not
Group a filter equation. These mask), filter expression (bit
packets form a data stream level), conditional expression
that may be captured or may (and, or, not) to other
generate events. filters.
events.
-----------------------------------------------------------------------------
Packet Allows packets to be captured Size of buffer for captured
Capture captured after they flow packets, full status (alarm),
Group through a channel. number of captured packets.
-----------------------------------------------------------------------------
Event Controls the generation and Event type, description, last
Group notification of events from time event sent.
this device.
-----------------------------------------------------------------------------