What is Remote Network Monitoring (RMON)?

By Morgana Siggins

June 30, 2020

Share: 

Having a remote monitoring system in place is critical to ensure a stable and efficient network operation. In fact, having visibility over your mission-critical devices will improve your company’s efficiency and bottom line.

For that, system technicians use network management tools that monitor the activity and performance of mission-critical equipment and network traffic. A common network management tool is the Simple Network Management Protocol (SNMP) along with remote network monitoring (RMON, which is an extension of SNMP) probe to gather and manage network data.

In order to properly use these tools to optimize your network performance you first need to know their nuts and bolts. In this article, we will talk about what exactly RMON is and how it can help you enhance the efficiency of your remote monitoring systems. So, let’s dive in.

What is RMON?

Remote network monitoring (RMON) is a method of monitoring network traffic on a remote Ethernet transport to find network issues. These issues can be dropped packets, network collisions, and even traffic congestion.

This successful network management protocol was originally developed by the Internet Engineering Task Force (IETF) in the early 1990s. IETF is an open organization consisting of network designers, operators, vendors and researchers, that develops and promotes voluntary internet standards.

RMON was developed specifically to address the weak points of a standard MIB, which lacked the ability to provide statistics on data link and physical layer parameters. RMON is designed to help network technicians to remotely monitor and analyze data that is collected from local area networks (LANs) without having to go to distant facilities to set up equipment.

With RMON, you can set performance thresholds and create alerts when these thresholds are crossed. This allows you to maintain a proactive network management strategy.

How Does RMON Work?

RMON probes, also called RMON agents, are hardware/software elements of a network device or a software embedded into this device, like a router or a switch.

Usually, the RMON probe is put on just one device or interface on a TCP/IP subnet. The probe software typically runs on the port of the network device to get information and statistics on network protocols and traffic activity. It can pass this information back to your SNMP manager console for analysis and reporting.

With RMON, you and your techs can monitor your network, save logs, create historic performance reports, and get notified in case an issue happens. All without interfering with your daily operations.

SNMP Vs RMON

Simple Network Management Protocol (SNMP) is an application-layer communication protocol used for monitoring and managing network devices on LANs or wide area networks (WANs). Sometimes, SNMP is even used to remotely control and configure remote equipment.

SNMP agents are usually the network devices that will allow communication between managed equipment and SNMP manager.

As I’ve said previously, RMON is an extension of SNMP and has nine groups of monitoring elements to allow you to capture all the details about your network information. This data refers to the physical layer (Layer 1) and the data-link layer (Layer 2) of the OSI model. As RMON agents monitor data over LAN networks, the gathered information is accessed by the SNMP manager using SNMP commands.

The SNMP protocol was originally developed as a tool for managing Transmission Control Protocol/Internet Protocol (TCP/IP), and Ethernet gateway, an extension of SNMP, was designed to allow monitoring of remote networks.

An SNMP device (a hub or router for example) normally needs additional software installed on it to give you RMON capabilities and turn it into a probe.

RMON Versions

RMON has two different network monitoring specifications. They are:

RMON1

RMON1 Management Information Base (MIB) provides network technicians with information about the health and performance of the network segment on which the RMON agent resides. This version gives you a view of the health of the whole segment, rather than the device-specific information that many non-RMON SNMP agents provide.

The benefits of RMON are obvious, but the scope of RMON1 is limited because it only focuses on the data link and physical layer parameters.

RMON Ethernet Groups

Group

Description

Statistics

Tracks packets, octets, packet-size distribution, broadcasts, collisions, dropped packets, fragments, CRC/alignment errors, jabbers, and undersized and oversized packets.

History

Stores multiple samples of values from the Statistics group for the comparison of the current behavior of a selected variable to its performance over the specified period.

Alarms

Enables setting thresholds and sampling intervals on any statistic to create an alarm condition. Threshold values can be an absolute value, a rising or falling value, or a delta value

Hosts

Provides a table for each active node that includes a variety of node statistics including packets and octets in and out, multicast and broadcast packets in and out, and error counts.

Host Top N

Extends the host table to offer a user-defined study of sorted host statistics. Host Top N is calculated locally by the agent, thus reducing network traffic and processing on the NMS.

Matrix

Displays the amount of traffic and the number of errors occurring between pairs of nodes within a segment.

Filters

Lets the user define specific packet-match filters and have them serve as a stop or start mechanism for packet-capture activity.

Packet Capture

Packets that pass the filters are captured and stored for further analysis. An NMS can request the capture buffer and analyze the packets.

Events

Lets the user create entries in a monitor log or generate SNMP traps from the agent to the NMS. Events can be initiated by a crossed threshold on a counter or by a packet-match count.

RMON2

RMON2 is an extension of RMON1. It adds nine more groups of data that pertain to the network layer (Layer 3) and application layer (Layer 7) of the OSI model.

RMON2 MIB gives you insights into RMON1 traffic statistics by specifying the protocol and applications that compose that traffic. Knowing this is vital in order to maintain and troubleshoot slave/master systems.

This version focuses mainly on higher traffic layers that exist above the medium access control (MAC) layer, Internet Protocol (IP) and application-level traffic. RMON2 facilitates network management applications to track all network layer packets.

RMON2 Groups

Group

Description

Protocol Directory

Provides a list of protocols supported by the device

Protocol Distribution

Contains traffic statistics for each supported protocol

Address Mapping

Contains network layer to MAC layer address mapping

Network Layer Host

Contains statistics for network layer traffic to or from each host

Network Layer Matrix

Contains network layer traffic statistics for conversations between pairs of hosts

Application Layer Host

Contains statistics for application layer traffic to or from each host

Application Layer Matrix

Contains application layer traffic statistics for conversations between pairs of hosts

User History Collection

Contains periodic samples of user-specified variables

Probe Configuration

Provides a standard way to remotely configure probe parameters such as trap destination and out-of-band management

Also, RMON2 agents are able to monitor the traffic coming to the LAN through routers and not just at the LAN to which it is attached.

However, keep in mind that RMON2 is not an upgraded version of RMON1 and certainly is not a replacement. In order to have complete visibility over your network, it’s important that you have the capabilities of both specifications.

The Bottom Line

The RMON Management Information Base is a more flexible and cost-effective solution to monitoring your network performance with proprietary protocols currently on the market. But, to get the most out of your remote monitoring system, you need a competent multiprotocol SNMP manager.

And the T/Mon LNX is just that. This master station’s network visibility capabilities allow you and your team to remotely identify potential problem sources on the network so they can be solved quickly or even before they grow into bigger issues.

With the T/Mon, you’ll have all the monitoring capabilities you need in only one interface. You’ll be able to easily manage your SNMP-enabled devices alongside any other equipment running on different protocols.

And that’s not all, to know more about the T/Mon and to get a free demo, give us a call.

Morgana Siggins

Morgana Siggins is a marketing writer, content creator, and documentation specialist at DPS Telecom. She has created over 200 blog articles and videos sharing her years of experience in the remote monitoring industry.