RMON - the story

RMON - the story

RMON is one more techno-babble acronym for some hot technology. RMON stands for Remote MONitoring, and is information that is used by network managers to remotely measure the performance and behaviour of a LAN segment. Before RMON, network administrators had to carry complicated network analysis equipment to where the problem was happening, and then try to diagnose and fix it. This is a big deal if you are a corporation with many users - RMON allows the administrators to diagnose very complex problems from a central location.

Is RMON hardware or software? It's both. There are always two pieces to RMON, a Probe and a Monitor. The probe is a special purpose computer that "listens" to all LAN traffic. The probe collects information about what's happening on the LAN like "how much of the network capacity is being used", or which workstations are transmitting or receiving information. The probe collects and saves this information in its memory until the monitor requests it. The monitor is a software program that runs on a PC or Unix workstation and displays the information received from the probe.

Is RMON different from SNMP? No. SNMP (Simple Network Management Protocol) is a general framework or language that allows network devices and management stations to exchange information. RMON is just a specific set of information that can be exchanged via SNMP.

Can I use RMON without SNMP? No. RMON can only communicate over SNMP and cannot exist without it.

Can I use SNMP without RMON? Absolutely. Our AT-View applications use SNMP to collect LAN performance information from our intelligent hubs and switches. SNMP can also be used to manage bridges, routers, printers, file servers and almost any other intelligent network device.

Who cares?

Why does anyone care about RMON? In a perfect world, nobody would. RMON is most often used by network administrators to solve problems. If nothing ever went wrong, no one would ever need RMON. However, things do go wrong and RMON has become a necessary part of the network administrator's toolbox.

For example, a common complaint from computer users on Ethernet LANs is poor response time. RMON could be used to identify the cause: for example, four or five users could be consuming all of the network's capacity. A RMON probe and monitor could tell the network administrator which workstations were the network hogs. A network administrator would then have the necessary information to fix the problem, and most importantly all this could be done without travelling to the remote location.

So why doesn't everyone use RMON? RMON is expensive. A full functioned RMON probe to monitor a single LAN segment costs about $3,000Ð$4,000. The monitor software for a Unix workstation usually costs another $4,000. In a large distributed network there can be many LAN segments (ATI is still a small company but we have over 25 LAN segments) deploying RMON probes throughout and organisation can be very expensive.

Is RMON a replacement for a Network Management Platform (NMP)? No! They solve different problems. NMPs are very good at discovering and monitoring the status of LAN components. In complex networks, the NMP keeps track of what devices are connected to the LAN and how those devices are configured. NMPs are meant to monitor and control an entire network made up of many segments, but are not very good at analysing the types of information flowing on those segments. In contrast, RMON probes and monitors cannot discover and monitor LAN components, and only monitor a single LAN segment, but they do an excellent job of monitoring the information flowing on a single LAN segment. What type of information does RMON give me?

RMON has nine different groups. They are:

Statistics: The Statistics group collects information about LAN performance (eg percentage Utilisation, number of bytes, CRC errors).

History: The History group is a record of cumulative data that can be used for trend analysis.

Hosts: The Hosts group is a collection of information about each network device and what type of information it is sending and receiving.

Top N: Statistical information sorted by host activity. For example which network devices were the most active.

Matrix: The traffic pattern between two network devices. For example, how much does workstation "A" talk to server "C" and what types of conversations are taking place?

Alarms: Alarms are used to set thresholds on values observed by the RMON probe. For example, an alarm could be set to alert the network administrator when percentage LAN utilisation exceeds 20 per cent.

Events: Events are actions that occur when a threshold is exceeded. For example, logging information to a file, or notifying a Network Management console that the event has occurred.

Filter: Filters allow the RMON probe to examine only certain types of network information. For example, the RMON probe could be configured to ignore all AppleTalk traffic or to collect information on all information requests from a Novell File Server.

Capture: Finally, capture allows raw or filtered data to be captured directly from the LAN and stored for future analysis.


Do I have to have a RMON probe to do RMON? No and Yes. Most of the information collected by a RMON probe can also be collected from other network devices. For example, ATI 36xx and 31xx series hubs and AT-View 2.0 (Unix) or AT-View for ManageWise 2.0 or AT-View for HP OpenView/Windows 2.0 do five of the nine RMON groups (Statistics, History, Top N, Alarms and Events). AT-View does this by using the built-in intelligence of ATI hubs. And because AT-View is seamlessly integrated into the Network Management platform the customer is using, information can be collected and unusual events monitored as part of normal operations. For many customers AT-View provides sufficient information to diagnose network problems or to profile network activity.

The other RMON groups (Hosts, Matrix, Filter and Capture) require a dedicated microprocessor and onboard memory to implement. These four RMON groups are often useful, but require a specialised RMON probe and RMON monitoring software.

Is that all there is to RMON? Yes. RMON is a LAN monitoring tool. It is extremely valuable for diagnosing difficult LAN problems, but it is not a replacement for a Network Management Platform like Spectrum or HP Open View. The good news is that we at ATI have an excellent and extremely cost-effective RMON solution today with AT-View and our Intelligent hubs, and a clear upgrade strategy and path for our customers with our full featured RMON probe and monitor software.

Vic Whiteley is Managing Director, Allied Telesyn International (Australia)

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.


Show Comments