Collecting RMON Data
The remote monitoring MIB (RMON) provides very detailed performance data. In this section we’ll focus on the Ethernet portion of RMON, which is in the original standard. Extensions for token ring and FDDI won’t be covered here. Recall that RMON agents are built into special probe devices, such as the HP LANProbe, which are attached to remote shared-medium Ethernet hubs to monitor them, as shown in Figure 9-10. These agents may be found in network equipment such as switches, where they can monitor all ports. While special software such as HP NetMetrix is best suited to controlling and managing RMON agents, simple Ethernet statistics can be collected using simple SNMP methods.
Figure 9-10. A shared medium RMON probe.
The network management station (NMS) uses standard SNMP requests to gather segment statistics from the remote RMON probe. The nodes indicated share the LAN medium and the RMON probe operates in a promiscuous [a.] mode to collect statistics such as total bytes, packets, errors, broadcasts, and multicasts. NNM can collect the simpler Etherstats group statistics while HP NetMetrix can control the probe to deliver sophisticated, end-to-end performance data across the enterprise network.
[a.] When it is operating in a promiscuous mode, a LAN adapter is able to capture all LAN frames present on the shared medium, even those not specifically addressed to it. This is a necessary feature for RMON probes and LAN analyzers in general. A LAN adapter is normally able to receive only frames addressed to its MAC address, the all-ones broadcast address, and possibly one or more multicast addresses.
The Etherstats group of the RMON MIB provides information about the LAN segment the probe is connected to. A shared medium LAN segment behaves exactly as does the traditional Ethernet cable and the Ethernet hub, repeater, or concentrator. All devices share the same medium, so a single RMON probe can monitor all the devices connected to it. A list of the performance variables in the RMON Etherstats group is given in Table 9-3.
| Variable | Description |
|---|---|
| etherStatsOctets | The total number of bytes counted. |
| etherStatsPkts | The total number of packets counted. |
| etherStatsBroadcastPkts | The number of MAC broadcast packets counted. |
| etherStatsMulticastPkts | The number of multicast packets counted. |
| etherstatsCRCAlignErrors | The number of frames with extra bits. |
| etherstatsUndersizePkts | The number of packets shorter than 64 bytes. |
| eterstats OversizePkts | The number of packets exceeding 1518 bytes. |
| etherStatsFragments | The number of collision fragments counted. |
| etherStatsJabbers | The number of jabber frames (> 8000 bits) seen. |
| etherStatsCollisions | The total number of collisions counted. |
| etherStatsPkts64Octets | The number of packets with exactly 64 bytes. |
| etherStatsPkts65to127Octets | The number of packets between 65 and 127 bytes in size. |
| etherStatsPkts128to255Octets | The number of packets between 128 and 255 bytes. |
| etherStatsPkts256to511Octets | The number of packets between 256 and 511 bytes. |
| etherStatsPkts512to1023Octets | The number of packets between 512 and 1023 bytes. |
| etherStatsPkts1024to1518Octets | The number of packets between 1024 and 1518 bytes. |
Be sure to load the RMON MIB on your NNM system using the xnmloadmib GUI before attempting to collect any data from the network. Note that none of these statistics actually measures LAN utilization. A MIB expression is needed that implements the formula:
%utilization = (etherStatsOctets×800)/ifSpeed
For example, for a standard Ethernet, ifSpeed is 10,000,000 bits per second, and let’s say you measure 600,000 octets per second. (As a practical matter, snmpCollect knows that etherStatsOctets is a Counter32 variable, so it actually differences successive samples and then divides by the number of seconds between samples, returning a rate measured in octets per second.) The formula returns 48% utilization. The variable etherStatsOctets is in the rmon group under the mib2 branch, while ifSpeed is under the interfaces group of mib2.
Note that standard RMON statistics measure only MAC layer statistics and are network-layer agnostic. To collect network-layer and application-layer statistics requires RMON2 and an application such as HP NetMetrix that can decode, present, and report the data efficiently. However, for simple shared-medium Ethernet, token ring, and FDDI LANs, standard NNM SNMP data collection suffices for basic segment-level performance management.