Configuring RMON Support

This chapter describes the Remote Monitoring (RMON) MIB agent specification, and how it can be used in conjunction with Simple Network Management Protocol (SNMP) to monitor traffic using alarms and events.

For a complete description of the RMON commands mentioned in this chapter, refer to the "RMON Commands" chapter in the "System Management" part of the Release 12.2 Cisco IOS Configuration Fundamentals Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.

The RMON option identifies activity on individual nodes and allows you to monitor all nodes and their interaction on a LAN segment. Used in conjunction with the SNMP agent in a router, RMON allows you to view both traffic that flows through the router and segment traffic not necessarily destined for the router. Combining RMON alarms and events (classes of messages that indicate traffic violations and various unusual occurrences over a network) with existing MIBs allows you to choose where proactive monitoring will occur.

Note Full RMON packet analysis (as described in RFC 1757) is supported only on an Ethernet interface of Cisco 2500 series routers and Cisco AS5200 series universal access servers. RMON requires that SNMP be configured (you must be running a version of SNMP on the server that contains the RMON MIB). A generic RMON console application is recommended in order to take advantage of the RMON network management capabilities. This feature supports RFCs 1757 and 2021.

RMON can be very data- and processor-intensive. Users should measure usage effects to ensure that router performance is not degraded by RMON and to minimize excessive management traffic overhead. Native mode in RMON is less intensive than promiscuous mode.

All Cisco IOS software images ordered without the explicit RMON option include limited RMON support (RMON alarms and event groups only). Images ordered with the RMON option include support for all nine management groups (statistics, history, alarms, hosts, hostTopN, matrix, filter, capture, and event). As a security precaution, support for the capture group allows capture of packet header information only; data payloads are not captured.

In Cisco IOS 12.1, the RMON agent was rewritten to improve performance and add some new features. Table 23 highlights some of the improvements implemented.

Table 23 RMON MIB Updates
Prior to the RMON MIB Update in Cisco IOS Release 12.1	New functionality in Cisco IOS Release 12.1
RMON configurations do not persist across reboots. Information is lost after a new session on the RMON server.	RMON configurations persist across reboots. Information is preserved after a new session on the RMON server.
Packet analysis applies only on the MAC header of the packet.	Complete packet capture is performed with analysis applied to all frames in packet.
Only RMON I MIB objects are used for network monitoring.	RMON I and selected RMON II objects are used for network monitoring.

•

usrHistory group. This MIB group is similar to the RMON etherHistory group except that the group enables the user to specify the MIB objects that are collected at each interval.

•

partial probeConfig group. This MIB group is a subset of the probeConfig group implemented in read-only mode. These objects implement the simple scalars from this group. Table 24 details new partial probeConfig group objects.

Table 24 partial probeConfig Group Objects
Object	Description
probeCapabilities	The RMON software groups implemented.
probeSoftwareRev	The current version of Cisco IOS running on the device.
probeHardwareRev	The current version of the Cisco device.
probeDateTime	The current date and time.
probeResetControl	Initiates a reset.
probeDownloadFile	The source of the image running on the device.
probeDownloadTFTPServer	The address of the server that contains the Trivial File Transfer Protocol (TFTP) file that is used by the device to download new versions of Cisco IOS software.
probeDownloadAction	Specifies the action of the commands that cause the device to reboot.
probeDownloadStatus	The state of a reboot.
netDefaultGateway	The router mapped to the device as the default gateway.
hcRMONCapabilities	Specifies the features mapped to this version of RMON.

Configuring RMON Alarm and Event Notifications

To enable RMON on an Ethernet interface, use the following command in interface configuration mode:

In native mode, RMON monitors only the packets normally received by the interface. In promiscuous mode, RMON monitors all packets on the LAN segment.

The default size of the queue that holds packets for analysis by the RMON process is 64 packets. To change the size of the queue, use the following command in global configuration mode:

To set an RMON alarm or event, us the following commands in global configuration mode, as needed:

Command	Purpose
Router(config-if)# rmon {native \| promiscuous}	Enables RMON.

Command	Purpose
Router(config)# rmon queuesize size	Changes the size of the RMON queue.


Command	Purpose
Router(config)# rmon alarm number variable interval {delta \| absolute} rising-threshold value [event-number] falling-threshold value [event-number] [owner string]	Sets an alarm on a MIB object.
Router(config)# rmon event number [log] [trap community] [description string] [owner string]	Adds or removes an event in the RMON event table.

You can set an alarm on any MIB object in the access server. To disable an alarm, you must enable the no form of this command on each alarm you configure. You cannot disable all the alarms you configure at once. Refer to RFC 1757 to learn more about alarms and events and how they interact with each other.

The RMON MIB defines two traps, the risingAlarm and fallingAlarm traps generated when an RMON alarmEntry risingThreshold or fallingThreshold event occurs. Thresholds allow you to minimize the number of notifications sent on the network. Alarms are triggered when a problem exceeds a set rising threshold value. No more alarm notifications are sent until the agent recovers, as defined by the falling threshold value. This means that notifications are not sent each time a minor failure or recovery occurs.

Configuring RMON Groups

RMON tables can be created for buffer capture, filter, hosts, and matrix information. The buffer capture table details a list of packets captured off a channel or a logical data or events stream. The filter table details a list of packet filter entries that screen packets for specified conditions as they travel between interfaces. The hosts table details a list of host entries. The matrix table details a list of traffic matrix entries indexed by source and destination MAC addresses.

To gather RMON statistics for these data types, use the following commands in interface configuration mode, as needed:


Command	Purpose
Router(config-if)# rmon collection history {controlEntry integer} [owner ownername] [buckets bucket-number] [interval seconds]	Enables an RMON history group of statistics on an interface.
Router(config-if)# rmon collection host {controlEntry integer} [owner ownername]	Enables an RMON host collection group of statistics on an interface.
Router(config-if)# rmon collection matrix {controlEntry integer} [owner ownername]	Enables an RMON matrix group of statistics on an interface.
Router(config-if)# rmon collection rmon1 {controlEntry integer} [owner ownername]	Enables all possible autoconfigurable RMON statistic collections on an interface.

To specifically monitor these commands, use the show rmon capture, show rmon filter, show rmon hosts, and show rmon matrix EXEC commands listed in the following table.

Monitoring and Verifying RMON Configuration

To display the current RMON status, use one or more of the following commands in EXEC mode:


Command	Function
`Router> show rmon` or Router> show rmon task	Displays general RMON statistics.
Router> show rmon alarms	Displays the RMON alarm table.
Router> show rmon capture	Displays the RMON buffer capture table and current configuration. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.
Router> show rmon events	Displays the RMON event table.
Router> show rmon filter	Displays the RMON filter table. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.
Router> show rmon history	Displays the RMON history table. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.
Router> show rmon hosts	Displays the RMON hosts table. Available only on Cisco 2500 series routers and Cisco AS5200 access serverss.
Router> show rmon matrix	Display the RMON matrix table and values associated with RMON variables. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.
Router> show rmon statistics	Display the RMON statistics table. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.
Router> show rmon topn	Display the RMON top-n hosts table. Available only on Cisco 2500 series routers and Cisco AS5200 access servers.

RMON Configuration Examples

Alarm and Event Example

This example creates RMON event number 1, which is defined as "High ifOutErrors", and generates a log entry when the event is triggered by an alarm. The user "owner_a" owns the row that is created in the event table by this command. This example also generates an SNMP trap when the event is triggered.

The following example configures an RMON alarm using the rmon alarm global configuration command:

This example configures RMON alarm number 10. The alarm monitors the MIB variable ifEntry.20.1 once every 20 seconds until the alarm is disabled, and checks the change in the rise or fall of the variable. If the ifEntry.20.1 value shows a MIB counter increase of 15 or more, such as from 100000 to 100015, the alarm is triggered. The alarm in turn triggers event number 1, which is configured with the rmon event command. Possible events include a log entry or an SNMP trap. If the ifEntry.20.1 value changes by 0, the alarm is reset and can be triggered again.

show rmon Command Example

To display the RMON buffer capture table and current configuration, enter the show rmon capture EXEC command (Cisco 2500 series routers and Cisco AS5200 access servers only). A sample configuration follows:

To view values associated with RMON variables, enter the show rmon matrix EXEC command (Cisco 2500 series routers and Cisco AS5200 access servers only). The following is a sample output:

For an explanation of the fields in the examples, refer to the respective command descriptions in the "RMON Commands" chapter of the Release 12.2 Cisco IOS Configuration Fundamentals Command Reference.

Table Of Contents