Remote Monitoring (RMON) is an extension to the SNMP MIB, and includes two versions – RMON and RMON 2. While SNMP relies on a regular polling and response mechanism between an NMS and individual managed devices to gather and collect information in real-time, the RMON protocol implements its monitoring capabilities using a batch-type method.
A typical RMON implementation consists of two major elements – a Network Management Station (NMS) and RMON probes. An RMON probe is a network device that collects information according to the traffic that passes through it, providing information about the health of the network itself, rather than a particular device. Unlike a traditional SNMP implementation, an RMON probe collects and stores this information, passing it to the NMS (via SNMP) when requested. As such, using RMON helps to avoid some of the network traffic issues associated with regular SNMP management. A typical RMON-enabled network will have one configured probe per segment.
RMON’s primary goal is to provide information relating to network errors and utilization. RMON data is gathered as part of nine different monitoring groups. Each of these provides information relevant to a different area of network monitoring such as gathering statistics, capturing packets, generating alerts, historical trend analysis, and so forth. While the original version of RMON was only capable of providing information up to the MAC level, RMON 2 is capable of monitoring traffic up to the application level. This allows information flows relating to particular applications to be assessed and analyzed.
RMON relies on being able to “see” all network traffic, which presents an issue in switched environments. As such, many network vendors now implement RMON probes as a feature within their switch products. For example, Cisco provides RMON probe capabilities within its Catalyst workgroup switches.
