RMON GUI - Remote network MONitoring
Administrator handbook
| |
RMON GUI - Remote network MONitoring |
Table of contents | |
The LoriotPro RMON GUI program/plugin cannot work without RMON probe(s).The RMON probe also called RMON agent is a dedicated device including hardware or software or it can be software embedded into a network device like a router or a switch. RMON probe can also be software running on a standard operating system like Windows or Linux. The application and the agent communicate across the network using the Simple Network Management Protocol (SNMP).
RMON probes capture or monitor data packets from the network. A good RMON probe should not impact the network likn and the flow.
RMON Probes have 3 methods for acquiring and reading data on switched enterprise networks:
The RMON probe functions may be present (embedded) in the network switches (Ethernet) and provide partial or full support of some RMON groups.
The switches operate at the physical and link level and therefore mainly provide statistics at these levels (RMON1) and often for only a few groups. Switch / router can provide support for groups RMON2 (case of Cisco and NAM).
Port mirroring is used on a network switch to send a copy of all network packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port.
Port mirroring capabilities are implemented in nearly all enterprise class switches. On typical enterprise switch, a port can be designated as the mirror port to which the RMON probe can be connected. The traffic from one or more network ports or from a VLAN can then be copied to the mirror port.
The switch-management utility is used to configure the selection of ports to be mirrored.
Some switches are only able to mirror incoming traffic of a port, while others are able to mirror both incoming and outgoing traffic of a mirrored port. Error packets are not mirrored to avoid the forwarding of corrupted traffic.
The limitation of port mirroring is the bandwidth usage of the mirror port, multiple ports or VLAN mirrored to one port can cause buffer overflow and dropped packets. Since packets go through a buffer and are retimed, accurate time-sensitive measurements, such as jitter, packet gap analysis or latency are difficult. In addition, most mirror ports filter anomalies, thus making trouble-shooting difficult.
Finally, port mirroring puts a load on the switch's CPU/transfer logic, thus impacting the switch's operational performance.
Port mirroring on a Cisco Systems switch is generally referred to as Switched Port Analyzer (SPAN); some other vendors have other names for it, such as Roving Analysis Port (RAP) on 3Com switches.
In-line taps are inserted directly into a network link (copper wire or fiber).
They split or copy the signals from both channels (full duplex) and retransmit the data streams hack out to the probe.
Optical taps contain a pair of passive optical beam splitters and no powered components. Light entering the tap from each channel is divided and separately channeled out to the link where the RMON probe can be connected. Beware that the light is effectively split in half thus an attenuation factor should be calculated into the optical power budget.
Taps are passive and fault tolerant devices. They do not require configuration. 10/100 Ethernet taps do not participate in link negotiation and are not visible to the network. Taps see 100% of the packets, as well as anomalies and timing values are accurate thus providing a real support for troubleshooting. Multiport switching taps can be used where any one of a set of links (servers, inter switch uplink) have to be remotely monitored in rotation or upon need.
Taps have to be permanently installed in backbone and critical links to avoid undesirable service outages when a tool is needed on a link.
RMON probe has to be connected to the TAP for traffic analysis and to the network with another interface for communicating in SNMP with the SNMP Manager (LoriotPro RMON GUI).
www.loriotpro.com |
|