cc/td/doc/product/rtrmgmt/switprob
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

Product Overview

Product Overview

Cisco SwitchProbe devices are hardware products with embedded firmware, designed to collect statistical information of an attached network segment.

Using the various Cisco SwitchProbe models, you can monitor different network topologies such as Ethernet, Fast Ethernet, Gigabit Ethernet, Multiport Fast Ethernet, Token Ring, Wide Area Network (WAN), OC-3 and DS-3 Asynchronous Transfer Mode (ATM), Fiber Distributed Data Interface (FDDI), and High-Speed Serial Interface (HSSI).

SwitchProbe devices support Remote Monitoring1 (RMON1), Remote Monitoring2 (RMON2), and Cisco's enhanced RMON extensions. These devices provide complete protocol monitoring and decoding when used with a client equipped with protocol decode software. All models also support the MIB II system and interface groups.

Each SwitchProbe device contains specialized firmware known as agent code. The firmware is the intelligence that is built into the device. The firmware consists of a series of commands that instruct the device to examine and gather statistical information about packets or cells passed along the network segment to which the device is attached. This statistical information is stored in continuous counters in random access memory (RAM). You can reset the counters to zero upon command.

In addition to gathering statistics, the SwitchProbe device supports filters and
packet- capture RMON1 groups so you can examine individual packets or sequences of packets to identify and isolate network problems. The device also supports all RMON2 groups and can decode packets from the network layer through the application layer of the OSI model. With this feature, you can monitor traffic on the basis of network layer protocols and addresses, and monitor application-level traffic.

A typical network is equipped with multiple SwitchProbe devices, with one device connected to each individual network segment or to the Switched Port Analyzer (SPAN) port on a Cisco Catalyst family switch.

You manage and control SwitchProbe devices from a centrally located traffic management console (using the TrafficDirector application) that is designated as the client. From the client, you can request and examine data provided by the agent you select. You can have multiple active clients and perform network diagnostic functions from multiple locations, such as from primary and secondary network management centers.

The following sections contain additional information:

How SwitchProbe Devices Are Used

When a SwitchProbe device is connected to the network segment or to the SPAN port on a switch, you can achieve greater network visibility.

Each port on a switch typically only supports mini-RMON. Mini-RMON supports four groups for monitoring network traffic—statistics, history, alarm, and events. When you attach a SwitchProbe device to a switch, you can achieve full RMON capabilities— RMON1 and RMON2 (see Tables 1-2 and 1-3)—so you can manage and monitor network traffic and isolate network problems.

Small Chassis Devices

The devices in the small chassis series measure 12 inches wide, by 13.5 inches deep, by
3 inches high (30.48 by 34.29 by 7.62 cm). They are housed in an external chassis that can be placed on a tabletop.

The interface cards in the small chassis series are located in the back of the device. They are available in different configurations with different combinations of interface types.

The following devices are part of the small chassis series:

Ethernet and Token Ring devices are intended for use in Ethernet and Token Ring environments. A single RMON agent is standard. An optional second Local Area Network (LAN) interface, and an RMON agent to monitor the second LAN link is also available. However, Cisco Systems recommends that you configure the second interface in manage mode only.

WAN SwitchProbe devices are used in WAN network applications where LAN traffic is transmitted over a wide area link. The WAN SwitchProbe devices with Ethernet use an RMON agent for a WAN link and include an Ethernet interface for connection to the network management software, or to monitor the LAN link.

Front-Access Chassis Devices

The devices in the front-access chassis measure 17 inches wide, by 16.5 inches deep, by 5.25 inches high (13.34 by 43.18 by 41.91 cm). They are housed in an external, rack-mountable large chassis for mounting in a 19-inch equipment rack.

Unlike the small chassis, where the interfaces are on the back of the device, the interfaces in these devices are in the front.

The front-access devices include an Ethernet interface for connection to the network management software.

The following devices are part of the front-access chassis series:

  Multiport Ethernet SwitchProbe devices are available in two configurations:
  Fast Ethernet SwitchProbe devices are available in the following configuration:
  Each WAN interface can monitor traffic per learned or configured data-link connection identifier (DLCI). The device can monitor up to 256 DLCIs aggregated from all interfaces.

For more information about the individual devices, see "Physical Description."

Table 1-1 provides a brief description of the devices available in the small and front-access series.


Table 1-1:
SwitchProbe Devices in the Small Chassis and
Front-Access Chassis Series
Chassis
Type
Description SwitchProbe Devices

Small

  • Dimensions (H x W x D)—
    3 x 12 x 13.5 in.
    (7.5 x 30 x 33.75 cm)

  • Can be placed on a table-top.

  • Interfaces are accessed from the back of the device.

  • Ethernet

  • Token Ring

  • WAN and Ethernet/Token Ring

Front-
Access

  • Dimensions (H x W x D)—
    5.25 x 17 x 16.5 in.
    (13.3 x 43.18 x 41.91 cm.)

  • Can be mounted in a standard 19-inch equipment rack.

  • Interfaces are accessed from the front of the device.

  • Multiport Ethernet

  • Fast Ethernet

  • Multiport Fast Ethernet

  • Gigabit Ethernet

  • FDDI Dual Attachment Station

  • FDDI Single Attachment Station

  • HSSI

  • Multiport T1/E1 WAN

  • Channelized T1/E1 WAN

  • Multiport T1/D or E1/D WAN

  • OC-3 ATM

  • DS-3 ATM

Compatibility with TrafficDirector Releases

Cisco Systems recommends using the following TrafficDirector releases with these SwitchProbe firmware releases:

Standards Supported in SwitchProbe Devices

Cisco SwitchProbe devices are based upon two widely accepted industry standards:

Other emerging standards are supported to allow you to simultaneously monitor multiple network segments from various topologies using the TrafficDirector application. These emerging standards include:

The following are Cisco proprietary standards:

Although the RMON-MIB standard does not specifically address Fast Ethernet, ATM, FDDI, and WAN media, Cisco Systems has adapted its basic monitoring and diagnostic functions to meet requirements for managing these essential links. For more information, see "Shadow MIB Implementations."

RMON Groups

The TrafficDirector application uses statistics based on the following RMON groups:

The TrafficDirector application can interpret and manipulate both RMON1 and RMON2 data; therefore, you can monitor all seven layers of the OSI model.

RMON1 Group

The RMON1 standard was developed under the guidance of the Internet Engineering Task Force (IETF) as an extension of its work in the development of the SNMP protocol. Using this standard, independent developers can design and develop monitoring equipment that interoperates and provides a standards base compatible with the widest range of network needs.

Because these groups have been defined, developers can implement products that include any or all of the nine groups for Ethernet or the ten groups for Token Ring. Some developers can supplement the defined groups with private MIBs that extend the functionality beyond the existing standard.

Table 1-2 summarizes the basic 10 RMON1 groups.


Note Four of the groups are considered components of mini-RMON, a version of the standard that allows the TrafficDirector application to communicate directly with many catalyst switches. When mini-RMON is embedded on the switch, the TrafficDirector application can gather a subset of RMON statistics known as vital signs, without requiring a SwitchProbe device.
Table 1-2: RMON1 Group
This Group... Provides This Functionality

Statistics

A mini-RMON group.
Counters for packets, octets, broadcasts, errors, and other statistics.

History

A mini-RMON group.
A historical representation of the statistics counters, based on user-defined sample intervals.

Hosts

A table of statistical counters for each host.

Host Top N

A user-defined subset (TopN) of the hosts, sorted by a statistical counter. By aggregating this data at the agent and returning only the results, management traffic is minimized.

Traffic Matrix

Traffic and errors between pairs of hosts.

Alarms

A mini-RMON group.
Thresholds, defined for any statistic, that return a trap to the management software. Alarms are the thresholds.

Events

A mini-RMON group.
SNMP traps based on the alarms group thresholds; also tracks alarms over time.

Filters

Criteria for selecting traffic for packet capture.

Packet Capture

Stores network traffic to be uploaded later to the management software.

Token Ring

Token Ring-specific information, including ring order and source routing.


SwitchProbe devices support the following:

RMON2 Group

Table 1-3 lists the major protocol domains in the RMON2 group that provide network-layer and upper-layer monitoring capabilities.


Table 1-3: RMON2 Group
This Group... Provides This Functionality

ProtocolDir

Management stations may query RMON SwitchProbe devices to learn from which domains they are collecting information.

ProtocolDist

Defines how much traffic is distributed across the various protocols on the network based on monitoring at the SwitchProbe device.

AddressMap

A list developed by the SwitchProbe device that matches host network addresses to MAC addresses.

N1Host

Network-layer host statistics.

N1Matrix

Network-layer host pair conversation statistics.

A1Host

Application-layer host statistics.

A1Matrix

Application-layer host pair conversation statistics.

usrHistory

User-specified logging capability.

probeConfig

Standards for SwitchProbe device configuration, such as a method to define the current date and time settings and reset controls, including running, warmBoot, and coldBoot states.

Enhanced RMON

Table 1-4 describes the enhanced RMON extensions included in the licensed software options.


Note To activate these software options, you must first purchase a license from Cisco Systems. To do so, contact your Cisco Systems sales representative. For more information about these options, see "Using Special Licensed Software Options."
Table 1-4: Licensed Software Options
This Software Option... Provides This Functionality

Resource Monitor

Monitors critical network resources.

NetFlow Monitor

Provides distributed monitoring of the router backbone.

VLAN Monitor

Collects RMON2 statistics for each VLAN on a network link.

ART MIB Monitor

Collects Application Response Time (ART) statistics.

Fast EtherChannel

Analyzes aggregating traffic of separate full- duplex Fast Ethernet segments into one full-duplex trunk.

WAN Decompression

Monitors a WAN link that contains compressed data.


In addition to the software options described in Table 1-4, Cisco's enhanced RMON extensions include the following functionality:

Default Groups

Default groups allow you to initialize the SwitchProbe as an RMON2 agent. When default groups are enabled and the SwitchProbe device is reset or powered on, the agent automatically installs the major protocol domains. For more information, see "Configuring the Default Domain" in "Configuring SwitchProbe Devices."

While you can only use the enhanced RMON functionality with the TrafficDirector application, SwitchProbe default RMON2 groups are compatible with some third-party management applications. You can configure the SwitchProbe agent to install these domains automatically by enabling default groups.

Router Discovery

SwitchProbe agents support router discovery. You can configure network routers to send out periodic router advertisements used by the agent to configure its default gateway address. If the agent does not receive any router advertisements for the duration specified in the last router advertisement message, the agent displays a message on the console. You can enable or disable this feature with the agent_options parameter in command-line mode. For more information, see "Using Command-Line Mode to Customize SwitchProbe Devices."

Agent Routing

SwitchProbe agent also include several routing options, including the ability to establish both semipermanent and permanent routes for individual IP addresses or subnets. A trap routing function also allows traps messages from other SNMP agents to be routed through the SLIP interface to alternative network management locations. These functions are often useful in implementing third-party maintenance operations at remote network management centers. For more information, see "Using Advanced Features."

Security Features

SwitchProbe agents support the SNMP community mechanism. You can configure the read and write community string in the agent. Any management station that tries to read from or write to the agent must use community strings that match those set on the agent. To read any data from the agent, the read community strings must match. To change any settings on the agent, the write community strings must match. For more information about read and write community strings, see "Configuring SwitchProbe Devices."

Configurable access lists give you enhanced security. The access list uses the IP address of the management station requesting access to determine what read and write privileges to grant. For more information about security, see "Using Advanced Features."

The local and remote SwitchProbe login consoles are password-protected. There are two login types:


hometocprevnextglossaryfeedbacksearchhelp
Posted: Wed Oct 2 08:07:49 PDT 2002
All contents are Copyright © 1992--2002 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.