RMON/RMON2 Supports Management Module SM-CSI1014

Transcription

1 Titlepage RMON/RMON2 Supports Management Module SM-CSI1014 Device Management

2 Copyright Notice Document Copyright 2003 by Aprisma Management Technologies, Inc. All rights reserved worldwide. Use, duplication, or disclosure by the United States government is subject to the restrictions set forth in DFARS (c)(1)(ii) and FAR Liability Disclaimer Aprisma Management Technologies, Inc. ( Aprisma ) reserves the right to make changes in specifications and other information contained in this document without prior notice. In all cases, the reader should contact Aprisma to inquire if any changes have been made. The hardware, firmware, or software described in this manual is subject to change without notice. IN NO EVENT SHALL APRISMA, ITS EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, OR AFFILIATES BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS MANUAL OR THE INFORMATION CONTAINED IN IT, EVEN IF APRISMA HAS BEEN ADVISED OF, HAS KNOWN, OR SHOULD HAVE KNOWN, THE POSSIBILITY OF SUCH DAMAGES. Trademark, Service Mark, and Logo Information SPECTRUM, IMT, and the SPECTRUM IMT/VNM logo are registered trademarks of Aprisma Management Technologies, Inc., or its affiliates. APRISMA, APRISMA MANAGEMENT TECHNOLOGIES, the APRISMA MANAGEMENT TECHNOLOGIES logo, MANAGE WHAT MATTERS, DCM, VNM, SpectroGRAPH, SpectroSERVER, Inductive Modeling Technology, Device Communications Manager, SPECTRUM Security Manager, and Virtual Network Machine are unregistered trademarks of Aprisma Management Technologies, Inc., or its affiliates. For a complete list of Aprisma trademarks, service marks, and trade names, go to All referenced trademarks, service marks, and trade names identified in this document, whether registered or unregistered, are the intellectual property of their respective owners. No rights are granted by Aprisma Management Technologies, Inc., to use such marks, whether by implication, estoppel, or otherwise. If you have comments or concerns about trademark or copyright references, please send an to spectrum-docs@aprisma.com; we will do our best to help. Restricted Rights Notice (Applicable to licenses to the United States government only.) This software and/or user documentation is/are provided with RESTRICTED AND LIMITED RIGHTS. Use, duplication, or disclosure by the government is subject to restrictions as set forth in FAR (June 1987) Alternate III(g)(3) (June 1987), FAR (June 1987), or DFARS (c)(1)(ii) (June 1988), and/or in similar or successor clauses in the FAR or DFARS, or in the DOD or NASA FAR Supplement, as applicable. Contractor/manufacturer is Aprisma Management Technologies, Inc. In the event the government seeks to obtain the software pursuant to standard commercial practice, this software agreement, instead of the noted regulatory clauses, shall control the terms of the government's license. Virus Disclaimer Aprisma makes no representations or warranties to the effect that the licensed software is virus-free. Aprisma has tested its software with current virus-checking technologies. However, because no antivirus system is 100 percent effective, we strongly recommend that you write-protect the licensed software and verify (with an antivirus system in which you have confidence) that the licensed software, prior to installation, is virus-free. Contact Information Aprisma Management Technologies, Inc. 273 Corporate Drive Portsmouth, NH Phone: U.S. toll-free: Web site: Device Management Page 2 RMON/RMON2

3 Contents INTRODUCTION 7 Purpose and Scope...7 Required Reading...8 RMON Management Module...8 SPECTRUM and RMON...8 RMON Models...9 Major Software Application Models...11 Minor Software Application Models...11 RMON Groups...12 Supported RMON Groups...12 RMONII Groups...13 MODELING RMON IN SPECTRUM 15 How to Model RMON...15 Creating a Device Model That Supports RMON...15 Configuring RMON as a Network Monitor Point...19 Associating an RMON Probe Model with a Network Interface...20 Copying RMON Probes into Network Models...23 Verifying the Monitor Point...25 CONFIGURING PROBES 27 LOADING AND UNLOADING PROFILES 29 What is a Profile...29 Checking Your Agent Configuration...29 Creating Custom Profiles Loading Profiles Problems When Loading Profiles Unloading Profiles Destroying/Recreating All Probes ICONS AND ICON COMPONENTS 34 The RMONApp Icon RMONApp Icon Subviews RMON Probe Icon Subviews The RMON Ethernet Probe Icon RMONEProbe Icon Subviews The RMON Token Ring Probe Icon RMONTProbe Icon Subviews Removing Probes NetScout Manager RMONII Features USING RMON 43 Loading and Unloading Profiles Accessing Ethernet Views Ethernet Statistics Viewing Performance Statistics on the Segment Viewing Network Activity with the Multi-Attribute Line Graph Viewing Statistics with the Details Button Device Management Page 3 RMON/RMON2

4 Contents Ethernet History...47 Configure Control Table View...47 History Control Table...47 Ethernet History Control Table View...48 Viewing the History Table...50 Hosts Control...50 Host Control Table...52 Viewing the Host Control Table...52 Viewing the Host Table Detail...54 Matrix Control Table View...54 Viewing the Matrix Table...56 HostTopN Control...58 Viewing or Configuring the Top Hosts...60 RMON Capture Packet View...62 Buffer Control View...62 The Control Table...64 New Filter Table View...66 Protocol Distribution (RMONII)...69 Protocol Distribution Table...69 Protocol Directory Table...70 Protocol Statistics View...71 Address Map Control View (RMONII)...71 Address Map Table...72 Network Layer (RMONII)...73 Network Host Table...76 Matrix TopN Control Table...77 Traffic Table...79 Destination Source Table...80 Source Destination Table...81 Matrix TopN Table...82 Contents Application Layer Accessing Token Ring Views Mac-Layer Statistics Viewing Performance Statistics on the Segment.. 85 Viewing Network Activity With the Multi-Attribute Line Graph Viewing Statistics with the Details Button Promiscuous Statistics Viewing Performance Statistics on the Segment.. 88 Viewing Network Activity With the Multi-Attribute Line Graph Viewing Statistics with the Frame Details Button.. 89 Mac-Layer History Viewing the History Table Promiscuous History Viewing the History Table Ring Station Viewing the Station Order Viewing Non-Isolating Errors Viewing Isolating Errors Other RMON Views Accessing RMON Alarms/Events CONFIGURING RMON ALARMS AND EVENTS 99 RMON Alarms Creating an Alarm Modifying and Enabling an Alarm Under Creation Modifying a Valid Alarm Removing an Alarm RMON Events Device Management Page 4 RMON/RMON2

5 Contents Creating an Event Modifying and Enabling an Event Under Creation Modifying a Valid Event Removing an Event Viewing the Event Log Traps Management Station RMON Agent Accessing the Trap Table Screen Configuring the Trap Table APPENDIX A 114 Ethernet Statistics Table Ethernet Statistics Detail View Frame Breakdown Chart Error Breakdown Chart Ethernet History Control Table History Table Hosts Control Table Host Table Host Table Detail Matrix Control Table Matrix Table User History Control Table HostTopN Control Table Top Hosts View APPENDIX B 126 Token Ring Fields and Statistics Contents Mac-Layer Statistics Table Mac-Layer Statistics Detail View Isolating Errors Chart Non-Isolating Errors Chart Event Breakdown Chart Mac-Layer History Control Table Mac-Layer History Table Promiscuous Statistics Table Promiscuous Statistics Detail View Frame Size Breakdown Promiscuous History Control Table Promiscuous History Table Hosts Tables Matrix Tables HostTopN Tables Ring Station Control View Station Order Table Non-Isolating Errors Isolating Errors APPENDIX C 145 SpectroWATCH Watches Enabling RMON Watches Modifying or Creating Watches Using Rmon Watches Logging Watches Ethernet Watches Device Management Page 5 RMON/RMON2

6 Contents APPENDIX D 151 Ethernet Profile Token Ring Profile and Token Ring Field Descriptions. 152 Using a Wildcard to Specify All Network Interfaces APPENDIX E 155 Object Identifiers (OIDs) etherstats historycontrol etherhistory hostcontrol host hosttime matrixcontrol matrixsd matrixds hosttopncontrol hosttopn alarm event log tokenringmlstats tokenringpstats tokenringmlhistory tokenringphistory ringstationcontrol ringstation Contents ringstationorder ringstationconfigcontrol ringstationconfig sourceroutingstats APPENDIX F 179 Report Description SetUp Monitor Point SpectroWATCH Logging Statistical Reports Standard Reports Custom Reports Running Reports Sample Statistical Report Output File INDEX 183 Device Management Page 6 RMON/RMON2

7 Introduction This section introduces the SPECTRUM Device Management documentation for the RMON Management Module. This introduction contains the following topics: Purpose and Scope Required Reading (Page 8) RMON Management Module (Page 8) SPECTRUM and RMON (Page 8) RMON Models (Page 9) Major Software Application Models (Page 11) RMON Groups (Page 12) Supported RMON Groups (Page 12) RMONII Groups (Page 13) Purpose and Scope Use this document as a guide for the RMON Management Module SM-CSI1014, which allows you to collect, manage, and monitor information about a remote LAN segment. This document describes the icons, menus, and views that enable you to remotely monitor, configure, and troubleshoot RMON through software models in your SPECTRUM database. Information specific to SM-CSI1014 is what is primarily included in this document. For general information about device management using SPECTRUM and explanations of SPECTRUM functionality and navigation techniques, refer to the topics listed under Required Reading. Device Management Page 7 RMON/RMON2

8 Introduction Required Reading To use this documentation effectively, you must be familiar with the information covered by the other SPECTRUM online documents listed below. Getting Started with SPECTRUM for Operators Getting Started with SPECTRUM for Administrators How to Manage Your Network with SPECTRUM SPECTRUM Views SPECTRUM Menus SPECTRUM Icons SPECTRUM Software Release Notice RMON Management Module The SPECTRUM RMON management module SM- CSI1014 currently lets you analyze networks that have been modeled in SPECTRUM. A management module is a C++ coded software emulation of a physical device or software agent. The management module uses icons based on X Windows/OSF Motif to represent this device in Required Reading the user interface. Management module icons provide visual status at a glance through the use of various color definitions, as well as access to in-depth information on the device s configuration and operating activity. The management module software allows a network administrator to model, monitor, and manage individual devices or groups of devices on a network. The RMON Management Module supports RMON agents managed through the SNMP basic network management agent. SPECTRUM bases its device management on the Management Information Base (MIB) which comes as part of the management module. SPECTRUM and RMON Remote Network Monitoring, or RMON, was developed by the Internet Engineering Task Force (IETF) as a means of monitoring remote networks using the SNMP protocol. The resulting RMON MIB provides a uniform, standards-based framework that management stations can use to obtain performance data from an entire network segment. Based on the levels depicted in the OSI Model, RMON allows monitoring at the Layer 2 MAC level. RMONII, with its emphasis on IP and Application Layer traffic, was developed to allow monitoring of all network traffic at the higher levels. Device Management Page 8 RMON/RMON2

9 Introduction RMON provides a means of distributing network monitoring functions down through the network to remote devices. Management station processing power and network bandwidth become freed up, and the overall efficiency of a local or wide-area network improves. The SPECTRUM Remote Monitoring (RMON) Management Module monitors and manages RMON agents on remote LAN segments through the use of SPECTRUM s graphical user interface and Inductive Modeling Technology (IMT). Using the RMON Management Module, network administrators can check the performance of their remote network segments, gather statistics for problem identification and resolution, and diagnose network problems remotely. Many manufacturers provide RMON support on their SNMP managed devices, however the RMON features may require device specific enabling and configuration to be accessible for network management use. You should refer to the vendor's device-specific documentation for this information. RMON devices can do the following: Collect a wide variety of detailed statistics for use in trend analysis Sort statistics by host for usage analysis Respond to user-defined thresholds applied to any of the statistical data RMON Models In addition, RMON devices provide extended monitoring capability. Because the RMON agent monitors every network device, it can track the performance of older devices that were previously inaccessible, such as those that are not compliant with SNMP. (For a list of supported devices, see Supported RMON Groups on Page 12.) RMON Models Every network device has one or more network interfaces through which it connects to network segments, and thereby to the network. These interfaces are communications ports of the device which are physically connected to the network and carry network traffic to and from the device. An RMON agent running on a network device collects and maintains RMON data for each interface on the device. The RMON Management Module supports three types of models to represent the RMON agent and its supported applications and interfaces. When you use SPECTRUM to model a device that supports RMON, RMON models are created automatically within SPECTRUM s Application View. The following sections provide a description of these models and their relationship to each other. Device Management Page 9 RMON/RMON2

10 Introduction RMON Models An RMONApp model accesses and presents RMON data from all network interfaces supported by a device. An RMON probe model accesses and presents RMON data specific to one interface. Depending on your network, the probe models are specific to Ethernet or Token Ring. Icons for the RMONApp model and RMON probe model appear in SPECTRUM s Application View. Icons are graphical representations of the models that exist within the SPECTRUM database. From the icons, you can access SPECTRUM subviews that provide detailed RMON data collected on the network interfaces that the models represent. Figure 1 shows a portion of a SmartSwitch Router (SSR-8) s application view, showing the RMONApp model and probe models. File View Name Contact Description Location Figure 1: Application View SpectroGRAPH: Application: Central_#2 Bookmarks Tools Network Address Primary Application dard RMON RMONApp RMON_App EnetProbe_#1 RMONEnetProb Central_#2 SSR-8 Bridging System Up Time Manufacturer Device Type Serial Number Help EnetProbe_#2 RMONEnetProb Device Management Page 10 RMON/RMON2

11 Introduction Major Software Application Models When a device is modeled, SPECTRUM automatically creates a model for each major software application (such as the RMONApp) that is present on the device. Major software application models appear in SPECTRUM s Application View in the first tier beneath the device model; black lines connect each major model directly to the device model. SPECTRUM associates major application models with the device model through the Model Type Editor s Manages relation. (For additional information about the Model Type Editor (MTE), see the SPECTRUM Model Type Editor Guide.) Information presented in the major application model is a summary of the minor software applications associated with it through the MTE s Provides relation. The RMONApp model represents the RMON MIB in the RMON device s Application view. Major Software Application Models Minor Software Application Models When a device is modeled, SPECTRUM automatically creates a model for each minor software application (such as an RMON probe) that is present on the device. Minor software application models appear in SPECTRUM s Application View beneath the first tier of major models; black lines connect each minor model directly to its major model (see Figure 1). SPECTRUM associates minor application models with the major software application models through the MTE s Provides relation. The RMONEthProbe model represents the RMON MIB in an Ethernet device s application view. SPECTRUM creates an RMONEthProbe model for each Ethernet interface supported by the device. The RMONTRProbe application model represents the RMON MIB in a Token Ring device s application view. SPECTRUM creates an RMONTRProbe model for each Token Ring interface supported by the RMON device. A probe model can provide monitor point capabilities when pasted into a SPECTRUM or LAN segment model. Refer to Configuring RMON as a Network Monitor Point for instructions Device Management Page 11 RMON/RMON2

12 Introduction about how to designate a probe as a monitor point. (For general information about monitor points, refer to the SPECTRUM System Administrator s Guide.) RMON Groups The RMON MIB, which is based on RFC 1757 (which obsoletes RFC 1271) (Ethernet) and RFC 1513 (Token Ring), is divided into the following groups: Statistics History Alarm Host HostTopN Matrix Filter Packet Capture Event Token Ring RMON Groups Each group defines a set of objects to be monitored. In addition, each group stores data and statistics collected by the agent on the device, which may have multiple network interfaces. Supported RMON Groups The RMON Management Module supports all of the following groups. Group Statistics History Alarm Host Description Maintains low-level utilization and error statistics for each subnetwork monitored by the agent. Statistics include packet counts, error breakdown, and frame size breakdown. Records periodic statistical samples over specified intervals. Monitors user-selected statistics and compares them to user-defined rising and falling thresholds, generating alarms when the thresholds are reached or exceeded. Maintains statistics associated with each host, or node, on the subnetwork. The agent discovers hosts automatically as the source and destination MAC addresses of good packets are recorded. Device Management Page 12 RMON/RMON2

13 Introduction HostTopN Contains the top-performing host statistics from a list based on parameters in the host table. You can use the statistics to identify trends, such as the top three error-producing nodes or the top ten traffic-producing nodes. Matrix Filter Packet Capture Event Token Ring Maintains statistics associated with each host pair, or source and destination addresses, on the subnetwork. Allows packets to be captured with an arbitrary filter expression. A logical data and event stream or channel is formed by the packets that match the filter expression. Allows packets to be captured after they flow through the channel. The group consists of buffercontroltable and capturebuffertable and requires implementation of the filter group. Controls the generation and notification of events from the monitoring agent. These subgroups provide monitoring functions for Token Ring: Ring Station Group Provides information about each station on the ring, as well as each ring being monitored. Ring Station Order Group Provides the order of stations on the monitored ring. Ring Station Configuration Group Actively manages stations on the ring. Source Routing Group Displays utilization statistics derived from source routing information. RMONII Groups RMON Groups RMONII is an extension of RMON that focuses on higher layers of traffic above the MAC layer, with an emphasis on IP and Application level traffic. The RMON Management Module supports all RMONII groups. A brief description of each follows: Group Protocol Directory Group Protocol Distribution Group Address Map Group Network Layer Host Group Network Layer Matrix Group Description Lists the inventory of protocols the probe can monitor and allows addition, deletion, and configuration changes. Collects the relative amounts of octets and packets for the different protocols detected on the network segment. Lists MAC addresses to the network address bindings discovered by the probe and on what interfaces they were last seen. Counts the amount of traffic sent from and to each network address discovered by the probe. Counts the amount of traffic sent between each pair of network addresses discovered by the probe. Device Management Page 13 RMON/RMON2

14 Introduction Group Application Layer Function User History Collection Group Note: Description The Application Layer host, matrix and matrixtopn functions report on protocol usage at the network layer and higher. Note that the use of the term Application Layer does not imply that only Application Layer protocols are counted. It means that protocols up to and including the Application Layer are supported. The usrhistory group combines mechanisms seen in the alarm and history groups to provide user-specified history collection. This utilizes two additional control tables and one additional data table. This function has traditionally been done by NMS applications via periodic polling. The usrhistory group allows this task to be offloaded to an RMON probe. These views are accessible directly from the current RMON Application Icons. No new icon has been created. RMON Groups The rest of this document covering management module SM-CSI1014 is organized as follows: Modeling RMON in SPECTRUM (Page 15) Loading and Unloading Profiles (Page 29) Icons and Icon Components (Page 34) Using RMON (Page 43) Configuring RMON Alarms and Events (Page 99) Appendix A (Page 114) Describes Ethernet fields and statistics displayed in the RMON tables. Appendix B (Page 126) Describes Token Ring fields and statistics displayed in the RMON tables. Appendix C (Page 145) Describes SpectroWATCH s Watch Information report. Appendix D (Page 151) Provides sample profiles for Ethernet and Token Ring. Appendix E (Page 155) Provides object IDs (OIDs) that you supply during alarm creation. Appendix F (Page 179) Describes the Report Information Block (.rib) files included with the RMON Management Module. Device Management Page 14 RMON/RMON2

15 Modeling RMON in SPECTRUM This section describes the SPECTRUM views that contain RMON models, how to model and configure devices that implement an RMON agent, and how to set up RMON as a network monitor point. How to Model RMON Modeling RMON in SPECTRUM involves the following steps: Creating models of devices that support RMON Enabling the RMON Host and Default MIB components for a modeled device Optionally selecting an RMON probe model as the monitor point for the SPECTRUM network model Creating a Device Model That Supports RMON When you model RMON, the first step is to create a device model that supports RMON. Note: If you are modeling a Cabletron device, see Model Information View for steps you may have to perform before you create a device model. Device Management Page 15 RMON/RMON2

16 Modeling RMON in SPECTRUM Follow these steps to create a device model: 1 Navigate into SPECTRUM s Universe Topology View. 2 Select Edit from the File menu. 3 Select New Model from the Edit menu. 4 Select a model type that supports RMON from the Select Model Type dialog box. If your Model Type supports one of the following features the RMON application will appear in your Application view: Ethernet Statistics Ethernet History Event Table Token Ring MacLayer Statistics Token Ring Promiscuous Statistics To support RMON, devices must be configured with certain firmware versions and memory resources. For more information about RMON requirements, contact Aprisma Technical Support. 5 Click on OK. The Creation View dialog box for that device type appears. 6 In the model s Creation View dialog box, supply the following information: Creating a Device Model That Supports RMON - Model Name A unique name that identifies this device. - Network Address The device s Internet Protocol (IP) address. - Community Name The Community Name assigned locally to this device. The default value is public. See your network administrator to verify that the Community Name has not been changed from public to another access policy name before modeling this device. - Location The location where the device is installed. This field is optional. - Contact The contact person or group who can provide troubleshooting help. This field is optional. - Serial Number The device s serial number. - Security String A SPECTRUM Security String for the device model. Refer to the SPECTRUM System Administrator s Guide for details on setting up security in SPECTRUM. Device Management Page 16 RMON/RMON2

17 Modeling RMON in SPECTRUM Creating a Device Model That Supports RMON - Polling Interval The interval, in seconds, during which SpectroSERVER reads all attributes of the model that are flagged as POLLED. The default value is 60 seconds. - Log Ratio The number of poll cycles that must occur before SpectroSERVER records any attributes that are flagged as LOGGED. The default value is After entering the parameter information, click on OK. SPECTRUM places the icon representing the device at the top of the window. To move the icon to another area of the window, drag it with the left mouse button while still in Edit mode. 8 To exit Edit mode, select Save & Close from the File menu. Device Management Page 17 RMON/RMON2

18 Modeling RMON in SPECTRUM Figure 2: Creating a Device Model That Supports RMON Model Information View File View Tools Bookmarks SpectroGRAPH: _Standard RMON Help RMON Model Information View Model Name Contact Description Network Address System Up Time Manufacturer Device Type Location Primary Application Gen_Bridging Serial Number MM Name MM Part Number MM Version Number Model Type Model Creation Time Model Created by Model State Security String General Information Communication Information DCM Timeout DCM Retry Community Name Mgmt Protocol Log Information LOGGED Condition Condition Value Contact Status Device Management Page 18 RMON/RMON2

19 Modeling RMON in SPECTRUM Now that you have created a model of the device and have enabled the RMON Host and Default MIB components, you have the option of configuring RMON to be a network monitor point. A monitor point is a device that collects statistical information from a network. The statistics are used to calculate total network activity. Configuring RMON as a Network Monitor Point When you work with RMON, you have the option of configuring an RMON probe model as a network monitor point for the given segment or ring. A monitor point is a device within a network group model (such as a LAN_802_3 or LAN_802_5 network) that provides the statistics that are used to calculate network activity in the network group model s Performance View. The specific monitor point device is selected by SPECTRUM based on the value of its Monitor Precedence attribute. Within a network model, the device model having the highest Monitor Precedence value becomes the monitor point for that network group. If more than one device has the same Monitor Precedence value, the first device seen is chosen. Typically, the highest precedence value belongs to network analyzing devices, followed by successively less Configuring RMON as a Network Monitor Point intelligent devices. You can modify default precedence values by updating them in a network s Information View. As described below, to use RMON as a monitor point in a network model, you may first make a copy of an RMON probe and paste it into the network model. When you copy a probe model into a network model, an instance of the statistics group is automatically created on the device which the probe model represents. This instance is owned by the monitor point and provides the statistics for the monitor point feature. For more information about the statistics group, refer to Appendix A. Also the eth/probe and the rt/probe are now placed in the LAN container automatically. For Ethernet devices an instance of the Ethernet Statistics is created, and for Token Ring an instance of MAC Layer Statistics is created. When the probe model is removed from the network model, the instances created for the monitor point are deleted. To make RMON a network monitor point, you must accomplish these tasks: Associate the probe model with a network interface Device Management Page 19 RMON/RMON2

20 Modeling RMON in SPECTRUM Configuring RMON as a Network Monitor Point Copy the probe model into the network model at that interface Select the probe model as the monitor point The following sections describe these modeling tasks. For additional information about the SPECTRUM monitor point feature, refer to the SPECTRUM System Administrators Guide. Associating an RMON Probe Model with a Network Interface The first step in making RMON a network monitor point is to associate the probe model with a network interface. An RMON probe model that monitors a network interface can be a monitor point only for the network connected to that interface. To understand how to identify the SPECTRUM network model at that interface, let s use the configurations shown in Figure 3 and Figure 4 as examples. Figure 3 depicts a typical network configuration of an EMME. Three of its network interfaces are dedicated to separate networks. Device Management Page 20 RMON/RMON2

21 Modeling RMON in SPECTRUM Figure 3: Configuring RMON as a Network Monitor Point Example of an EMME Model Configuration Assembly LAN_802_3 Channel C HQ Channel B HubCSIEMME Channel D Design Sales LAN_802_3 LAN_802_3 To find out which network interface is attached to each network, you need to inspect the DevTop view of the EMME model, shown in Figure 4. Device Management Page 21 RMON/RMON2

22 Modeling RMON in SPECTRUM Configuring RMON as a Network Monitor Point Figure 4: SSR-8 DevTop View Chassis DevTop View Interface DevTop View SmartSwitch ROUTER Ether100 Control Ether100 Ether100 File View Tools Bookmarks Help Model Name Model Type Model Name Model Type 1 ON Ethernet Bd.Pt ON Ethernet Bd.Pt ON Ethernet Bd.Pt ON Ethernet Bd.Pt 2.4 0:0:0:0 0:0:0:0 0:0:0:0 0:0:0:0 Device Management Page 22 RMON/RMON2

23 Modeling RMON in SPECTRUM In Figure 4, three of the SSR s network interfaces are associated with a network model at that interface. For example, interface 2 is associated with the Design network model. Thus, using the information from the DevTop view, the RMON Probe models and the SPECTRUM network models are associated as follows: Network Interface Channel Probe Model 2 B E Probe 02 Design Network Model 3 C E Probe 03 Assembly 4 D E Probe 04 Sales Configuring RMON as a Network Monitor Point Copying RMON Probes into Network Models To designate an RMON probe model as a monitor point, copy the RMON probe model from the device s Application View and paste it into the corresponding or network model. The RMON Probe becomes a monitor point device within that segment. Follow these steps: 1 Open the Application View for the device you modeled. 2 Select Edit from the File Menu. 3 Highlight the probe that you want to copy. 4 Select Copy from the Edit Menu. 5 Open the Topology View for the discrete LAN. 6 Select Edit from the File Menu. 7 Select Paste from the Edit menu. Device Management Page 23 RMON/RMON2

24 Modeling RMON in SPECTRUM Figure 5: Configuring RMON as a Network Monitor Point RMON Modeling Process Model for device supporting RMON User copies the RMONEth or RMONTR Probe model from the Application View and pastes it into the respective LAN_802_3 or LAN_802_5 subnet model LAN_802_3 LAN_802_5 Device Management Page 24 RMON/RMON2

25 Modeling RMON in SPECTRUM Verifying the Monitor Point The last step in the monitor point process is to verify that the RMON Probe is selected as the monitor point for the LAN. If you configure the RMON Probe to be the monitor point device, RMON segment performance data is presented in the Performance View of the network model. Within a network model, the device or probe model having the highest Monitor Precedence value becomes the monitor point for that network model. If more than one of these models has the same Monitor Precedence value, the first model created is chosen. The RMON Ethernet and Token Ring probes have monitor precedence values of 60. For additional information about monitor points and monitor precedence values, see the SPECTRUM System Administrator s Guide. Configuring RMON as a Network Monitor Point Note: The RMONTRProbe application will not support monitor point capabilities if the Token Ring Mac- Layer or Promiscuous Statistics group is not supported by the device. Likewise, the RMONEthProbe application will not support monitor point capabilities if the Ethernet Statistics group is not supported by the device. To verify that the RMON probe is the monitor point, perform the following steps: 1 Navigate to the Topology view that contains the network model. 2 Highlight the probe s network model by clicking on it. 3 Click the right mouse button and select Information from the Icon Subviews menu. The LAN Information View appears (see Figure 6). 4 Verify that the values displayed in the monitor point information fields (located in the lower right portion of the view) indicate that the pasted Probe model is now the monitor point. Device Management Page 25 RMON/RMON2

26 Modeling RMON in SPECTRUM Configuring RMON as a Network Monitor Point Figure 6: Lan Information View To select a monitor point, or to modify an existing one, follow these steps: 1 Highlight the desired monitor point from the Select Monitor Point list and click OK. 2 Verify that the selected monitor point is now displayed in the Monitor Point Model Name field. E Probe 01 CSIRptr Ch1 45 EProbe E 1 01 RMONEthProbe Available monitor Selected monitor point Device Management Page 26 RMON/RMON2

27 Configuring Probes This section gives an overview of how to use the RMON Probe Configuration view. Access: From the Icon Subviews menu for the RMON Probe Icon, select Configuring Probes. This view allows you to customize the configuration of RMON Probes. Use this feature for specific device configurations. The RMON Probe Configuration view provides descriptions for each possible mode of configuration directly in the view. RMON Probe Creation Mode Use the button to select the particular mode in which RMON is configured on your device. The possible modes are listed below. No Probes Suppress the creation of RMON Probes. Configured Interfaces Interfaces configured to receive RMON statistics and are operationally On will create RMON Probe models. All Interfaces Creates RMON probes for all interfaces of type Ethernet, Gigabit Ethernet, and Token Ring. Unknown The initial setting for models migrated from older versions of SPECTRUM only. Changing the mode to this setting will have no affect. In order to implement your changes, select File > Save All Changes. The changes will take a few seconds to implement. These changes will then appear in the Application view. Device Management Page 27 RMON/RMON2

28 Configuring Probes Note: In order to change the default value for all devices, use the Model Type Editor and change the default value for the ProbeCreationMode attribute in the Model Type RMONApp. All devices that are created after editing the ProbeCreationMode attribute will use the new default value. Device Management Page 28 RMON/RMON2

29 Loading and Unloading Profiles This section describes how to set up, load, and unload profiles. What is a Profile Default control table instances of each RMON group are created on the device when the agent is started. In addition to these instances, you can download customized instances by using information stored in an ASCII file called a profile. Each profile specifies the control table characteristics you want to view. By using customized profiles, you can manually load and unload RMON control table information. You can set up standard profiles in advance. You can download as many instances of each group as you like and are limited only by the resources available to the agent to support them. You can also remove instances. (Note that RMON Alarms/Events information cannot be loaded from profiles. Alarms and events must be created manually through the RMON Alarms/Events View.) To access the Profile Load/Unload View, select Profile Load/Unload from the RMONApp model s Icon Subviews menu. Checking Your Agent Configuration The Profile Load/Unload View allows you to check which RMON groups are supported and enabled on the agent. You cannot, however, use this view to enable and disable the RMON groups themselves. When you click on the Check Configuration button in the Profile Load/Unload View, the agent is queried for the RMON groups that are supported. Darkened buttons in the lower portion of the Profile Load/Unload View indicate those RMON groups that are supported and enabled. This action also updates the Icon Subviews menu of the RMON Application models for that agent, ensuring that the available menu selections match what is supported by the agent. Note that the Reset View button only initializes the view; it has no effect on the agent at all. Device Management Page 29 RMON/RMON2

30 Loading and Unloading Profiles Creating Custom Profiles Aprisma provides starter files that you can use to create your own custom profiles. The starter files are located in the directory /Spectrum_install_area/SS/CsResource/RMON_ Profiles. Note that the files are intended only as starter files; their configuration may not match your supported RMON groups or suit your needs. See Appendix D for examples and descriptions of the format and syntax of profiles. To create your own profile from one of the starter files, follow these steps: 1 Navigate to the default directory where the SPECTRUM profiles are located: cd /<SPECTRUM_Directory_Path>/SS/CsResource/RMON_Profiles 2 Copy the sample profile you want to use and give the copy a unique file name, as shown in the following example: cp csi-dflt.pro my-dflt.pro 3 Edit the new profile with any text editor and customize the file according to the RMON configuration you want to load with the profile. You can include some or all of the Creating Custom Profiles RMON groups that are supported by your agent. 4 After all changes have been made, save the changes and then close the profile. Loading Profiles When you load a profile, the load process uses the resource_file_path parameter in your ss/.vnmrc file as the root path in its search for the specified profile. Aprisma supplies an RMON_Profiles directory in this area, where you can find sample profiles and also store your custom profiles. To load a profile, follow these steps: 1 Select the Profile Load/Unload View from the RMONApp model s Icon Subviews menu. 2 In the Profile File field, enter the path specification followed by your profile s name. Note that the path specification must be relative to the resource_file_path parameter specified in the ss/.vnmrc file. The following example shows the correct syntax for the default configuration: RMON_Profiles/<profile_name> Device Management Page 30 RMON/RMON2

31 Loading and Unloading Profiles 3 Ignore the OwnerString field. This field will be updated with information from the profile during the profile load process. 4 In the Errorlog field, enter a name for the error log file. This file will contain error log entries that occur during the profile load process. See the following section, Problems When Loading Profiles, for additional information about the error log file. 5 You must save your Profile View changes prior to loading, or they will have no effect. Click the right mouse button, or select Save All Changes from the File menu, and click OK in the dialog box that appears. 6 Click on Load Profile. The message Profile processing completed indicates the profile has been evaluated and the agent has been loaded with the control table information. You can now go to any updated RMON group and view the new configuration. If the message Error accessing file appears, close the message box and verify the accuracy of pathnames and file permissions. If you make any changes, be sure to save the updated information as described in Step 5. Loading Profiles Problems When Loading Profiles When an error occurs while a profile is being loaded, the Profile Load/Unload parsing mechanism aborts the profile loading process, generates a parser error message that corresponds to the error, and records an error log entry in the error log file that you specified when you loaded the profile. Each error log entry includes a descriptive error message and the profile entry text that produced the error, as shown in the following examples. Device Management Page 31 RMON/RMON2

32 Loading and Unloading Profiles Unloading Profiles Figure 7: The UNIX pathname of the profile Error Log File Entries The line number indicating the location of the error within the profile Error reading numeric interface entry on line 17 in parse file /usr/data/spectrum/3.1/ss/csresource/rmon_profiles/mydflt.pro Error reading wildcarded interface entry on line 5 in parse file /usr/data/spectrum/3.1/ss/csresource/rmon_profiles/mydflt.pro Error reading parameterized interface entry on line 4 in parse file /usr/data/spectrum/3.1/ss/csresource/rmon_profiles/my- When the error message box is displayed, click on OK to close the message view. Review the error log file and then check your profile for syntax errors. Unloading Profiles Use the Profile Unload feature to remove default or user-configured instances from the agent Control Table and thereby free up resources on the device allocated to those instances. When you remove profile information, you specify what to remove according to the owner of the instance. Therefore, the removal process is not group-specific; all instances in all groups associated with the specified owner will be removed. To remove profile information, follow these steps: 1 Select the Profile Load/Unload View from the RMONApp model s Icon Subviews menu. Device Management Page 32 RMON/RMON2

33 Loading and Unloading Profiles 2 Ignore the Profile File field. (You need not modify this field.) 3 In the OwnerString field, specify the owner of the Control Table instances that you want to delete. 4 In the Errorlog field, enter a name for the error log file. This file will contain error log entries that occur during the profile unload process. See the previous section, Problems When Loading Profiles, for additional information about the error log file. 5 You must save your Profile View changes prior to unloading or they will have no effect. Click the right mouse button, or select Save All Changes from the File menu, and click OK in the dialog box that appears. 6 Click on Unload Owner. The profile information is removed from the Control Table. The message Profile processing completed indicates the profile has been evaluated and the agent s control table information has been updated. If the message Error accessing file appears, close the message box and verify the accuracy of pathnames and file permissions. If you make any Unloading Profiles changes, be sure to save the updated information as described in Step 5. Destroying/Recreating All Probes In the Profile Load/Unload view you may destroy all probes by clicking the Remove All Probes button. After removing all of the probes, you may recreate the probes by going to the Application view and proceeding as follows: 1 File -> Edit. 2 Edit -> Rediscover Applications. Device Management Page 33 RMON/RMON2

34 Icons and Icon Components This section describes the RMON models and discusses how you can use the icons (the RMONApp icon, the RMON Ethernet probe icon, and the RMON Token Ring probe icon) to obtain network performance data. The RMONApp Icon The RMONApp icon (Figure 8) serves as a central gathering point for network device information and allows you to easily access data collected from multiple interfaces on the device. Each RMONApp icon represents a composite of the information gathered by all of the Ethernet or Token Ring probes that belong to its model. The icon features three labels that provide quick access to detailed information about the model. To access the information, double click on the label, using the left mouse button. (You can also access this same information through the Icon Subviews menu.) Figure 8: StandardRMON RMONApp RMON_App Contact Status Label The label color reflects the device s contact status. See the SPECTRUM System User s Guide for an explanation of icon label colors. RMONApp icon Model Information View label This label displays the default or user-defined model name. Double click here to access the detailed Model Information View. Profile Load/Unload View label This label displays the model type name (RMONApp). Double click here to open the Profile Load/Unload View. The Profile Load/Unload feature allows you to control the categories that RMON monitors.function. Device Management Page 34 RMON/RMON2

35 Icons and Icon Components RMONApp Icon Subviews Icon subviews provide detailed information about the RMONApp model. To access the Icon Subviews menu, click the right mouse button anywhere on the icon. As an alternative, you can click on the RMONApp icon to highlight it and then select Icon Subviews from SPECTRUM s View menu.table 1 displays the menu selection for the RMONApp Icon. Table 1: Icon Subviews for the RMON App Menu Selection Description... Configure RMON Configure Control Table View (Page 47) Configuring Probes Profile Load/Unload Place Probes in the LAN Configuring Probes (Page 27) See Creating Custom Profiles (Page 30), Loading Profiles (Page 30), Unloading Profiles (Page 32). Allows you to place your probes into a LAN. The RMONApp Icon RMON Probe Icon Subviews Table 2 provides the possible menu selections. Table 2: Icon Subviews For the RMONProbe Menu Selection Ethernet Statistics Ethernet History Host Control Matrix Control Protocol Distribution Address Map Network Layer Opens the... Ethernet Statistics Table (Page 114) Ethernet History Control Table (Page 117) Hosts Control Table (Page 119) Matrix Control Table (Page 122) Protocol Distribution Table (Page 69) Address Map Table (Page 72) Network Layer (RMONII) (Page 73) Application Layer Application Layer Function (Page 14) Model Information The Model Information view. For information on this, refer to SPECTRUM Views. Device Management Page 35 RMON/RMON2

36 Icons and Icon Components The following list briefly describes menu selections for the Ethernet and Token Ring RMONApp icons. Note that some menu selections describe options that are topology-specific; for example, menu selections for Ethernet are not available on a Token Ring network and vice versa. Appendix A and Appendix B provide additional information about the statistics displayed by the menu selections. Selection Close Navigate Alarms Notes Utilities Profile Load/Unload Ethernet Statistics Mac-Layer Statistics Description Close the Icon Subviews menu. Move to a view higher or lower in the topology hierarchy. View alarms for the model. Open the Notes facility. Open the utilities submenu. Open the Profile Load/Unload View. View Ethernet statistics for each interface on the device. (Ethernet only) View a list of Mac-layer Token Ring statistics for each interface on the device. (Token Ring only) Selection Promiscuous Statistics Ethernet History Mac-Layer History Promiscuous History The RMONApp Icon Description View a list of Promiscuous Token Ring statistics for each interface on the device. View Ethernet statistics for each interface. View Mac-layer Token Ring statistics for each interface, gathered at user-specified intervals. (Token Ring only) View Promiscuous Token Ring statistics for each interface. Device Management Page 36 RMON/RMON2

37 Icons and Icon Components The RMON Ethernet Probe Icon Selection Hosts Control Matrix Control HostTopN Control RMON Alarms/Eve nts Model Information Description View network traffic statistics associated with each host on the network segment for each interface on the device. View network traffic statistics associated with each host communication pair on the network segment for each interface on the device. View top-performing host statistics on the network for each interface on the device. View and control RMON alarms and events. View configuration information about the model. The RMON Ethernet Probe Icon The RMON Ethernet probe (RMONEProbe) gathers statistics from any single interface on an Ethernet device. The RMONEProbe icon (see Figure 9) contains labels that provide access to detailed information about the model. For quick access to the information, double click on the label, using the left mouse button. (You can also access this same information through the Icon Subviews menu.) Device Management Page 37 RMON/RMON2

38 Icons and Icon Components The RMON Ethernet Probe Icon Figure 9: RMONEProbe Icon RMONEProbe Icon Subviews Contact Status Label The label color reflects the probe s contact status. See the SPECTRUM System User s Guide for an explanation of icon label colors. EnetProbe_#2 RMONEnetProb Ethernet Statistics Table View label This label displays the model type name (RMONEProbe). Double click here to open the RMON Ethernet Statistics Table View. The table lists Ethernet statistics entries measured by the probe at its associated network interface. See Appendix A for detailed information about these statistics. Model Information View label This label displays the default or user-defined name. The default name corresponds to the network interface with which this probe is associated. Double click here to access the detailed Model Information View. Click the right mouse button anywhere on the RMONEProbe icon to access the Icon Subviews menu, shown in Table 3. As an alternative, you can click on the RMONEProbe icon to highlight it and then select Icon Subviews from SPECTRUM s View menu. Table 3: RMONEPRobe Icon Subviews Menu Option Ethernet Statistics Ethernet History Host Control Matrix Control HostTopN Control Opens the... Ethernet Statistics Table (Page 114). Ethernet History Control Table (Page 117).. Hosts Control Table (Page 119). Matrix Control Table (Page 122). HostTopN Control Table (Page 123). Device Management Page 38 RMON/RMON2

39 Icons and Icon Components Table 3: User History Model Information RMONEPRobe Icon Subviews Menu Option Opens the... User History Control Table (Page 123) The Model Information view. For further information on Model Information views see SPECTRUM Views documentation. The RMON Token Ring Probe Icon on the label, using the left mouse button. (You can also access this same information through the Icon Subviews menu.) From this menu, you can select one of many subviews that present detailed information about the model. The menu selections are described in more detail in Using RMON. Appendix A provides additional information about the statistics displayed by the menu selections. The RMON Token Ring Probe Icon The RMON Token Ring probe (RMONTProbe) gathers statistics from a single interface on a Token Ring device. The RMONTProbe icon (see Figure 8) contains labels that provide quick access to detailed information about the model. For quick access to the information, double click Device Management Page 39 RMON/RMON2

40 Icons and Icon Components The RMON Token Ring Probe Icon Figure 10: RMONTProbe Icon RMONTProbe Icon Subviews Contact Status Label The labels color reflects the probes current contact status. See Spectrums User Guide for more information. TProbe_#1 RMONTProbe Model Information View Displays the default or user-defined name. Mac-Layer Statistics Table View This label displays the model type name(rmontprobe). Doubleclick here to open the RMON Mac-Layer Statistics Table View. The table list the Token Ring stats entries measured by the probe at its associated network interface. The statistics are free running counters that start at zero when a valid entry is created. See Appendix B for detailed information about these statistics. Click the right mouse button anywhere on the RMONTProbe icon to access the Icon Subviews menu, shown in Table 4. As an alternative, you can click on the RMONTProbe icon to highlight it and then select Icon Subviews from SPECTRUM s View menu. Table 4: Option Mac Layer Statistics Promiscuous Layer RMONTProbe Icon Subviews Opens the... Mac-Layer Statistics Table on Page 126. Promiscuous Statistics Table on Page 134. Host Control Hosts Tables on Page 140. Matrix Control Matrix Tables on Page 140 HostTopn Control Ring Station Model Information HostTopN Tables on Page 140. Ring Station Control View on Page 141. For more information refer to the Spectrum Views documentation. Device Management Page 40 RMON/RMON2

41 Icons and Icon Components Removing Probes The following are instructions for removing all Probes. Do the following to remove Probes: 1 Verify that the probes that are available off the RMONApp model are the ones which have been configured (i.e interfaces that are collecting RMON statistics). 2 From the Icon subviews menu for the RMONApp and click on RMON Profile Load/Unload Menu. 3 Click on the Remove All Probes button. 4 Now rediscover applications for the device and you should see all the RMON probes modelled again. The RMON Token Ring Probe Icon NetScout Manager In the bin directory that you installed NetScout Manager you must set the following variables before the NetScout Manager menu pick will appear in the Icon Subviews for the Device icon. Do the following to set the variables: 1 Set an environment variable NSBIN to point to the NetScout directory. 2 Type touch nsman.exe or touch rmonmgr.exe (exclude the.exe if on Solaris). The nsman.exe is the name of the menupick for NetScout Manager 3.0 and the rmonmgr.exe is called NetScout Manager Bring up the SPECTROGraph and the device model. 4 Either NetScout Manager 3.0 or NetScout Manager 5.0 or both are now displayed as menu picks depending on what executable you have installed in the bin directory. From this menu, you can select one of many subviews that present detailed information about the model. Appendix B provides additional information about the statistics displayed by the menu selections. Device Management Page 41 RMON/RMON2

42 Icons and Icon Components The RMON Token Ring Probe Icon RMONII Features The following features are part of RMONII that you may access from the Icon subviews menu. The following menu picks are available for the RMON II Application icon: Protocol Distribution (RMONII) (Page 69) Address Map Control View (RMONII) (Page 71) Network Layer (RMONII) (Page 73) Application Layer (Page 83) Refer to RMONII Groups on Page 13 for a brief description of the information found with these new features. Device Management Page 42 RMON/RMON2

43 Using RMON This section describes the RMON views that are available from the Icon Subviews menu. It also describes how you can tailor many of the views to suit your needs. Loading and Unloading Profiles Access: From the Icon Subviews menu for the RMONApp icon, select Profile Load/Unload. The Profile Load/Unload View allows you to manually load and unload RMON control table information that is stored in a file called a profile. This subview selection is available only from the RMONApp model. Refer to Loading and Unloading Profiles (Page 29) for detailed information about how to create, load, and unload RMON profiles. Ethernet Statistics From the Icon Subviews menu, click on Ethernet Statistics. The Ethernet Statistics Table shown in Figure 11 presents the RMON Statistics data in tabular form. Accessing Ethernet Views The following sections describe RMON views that appear on Ethernet icons. Refer to Appendix A for detailed descriptions of statistics that appear in Ethernet views. Device Management Page 43 RMON/RMON2

44 Using RMON Accessing Ethernet Views Figure 11: Ethernet Statistics Table Device Management Page 44 RMON/RMON2

45 Using RMON The RMON Statistics group consists of 17 parameters measured at the monitored network interface (data source) of the device. These statistics take the form of free running counters that start from zero when a valid instance is created. The Ethernet Statistics Table presents 13 of these parameters (briefly described below) but does not include detailed size distribution, which is presented in the Statistics Detail View described later in this section. Data Source The interface being monitored. Octets Total octets received. Packets Total packets received. Broadcasts Good packets received that were directed to a broadcast address. Multicasts Good packets received that were directed to a multicast address. Owner The person who configured the entry. CRC/Align Total packets received that had a length of between 64 and 1518 octets, but were not an integral number of octets in length or had a bad FCS. Collisions Best estimate of total number of collisions on this segment. Accessing Ethernet Views Fragments Total packets received that were not an integral number of octets in length or that had a bad FCS, and were less than 64 octets in length. Jabbers Total packets received, longer than 1518 octets, and not an integral number of octets in length or with a bad FCS. Oversized Total packets received, longer than 1518 octets, otherwise well-formed. Undersized Total packets received, less than 64 octets long, otherwise well-formed. Drop Events Total events in which packets were dropped due to lack of resources. Viewing Performance Statistics on the Segment Double click on any instance (row or interface) in the Ethernet Statistics table to view the RMON data presented in standard SPECTRUM Performance View format. This allows you to view current percentage calculations and a time graph of the interface activity, rather than the absolute numbers of the Statistics Table. Note that this view is dynamically updated. Device Management Page 45 RMON/RMON2

46 Using RMON Viewing Network Activity with the Multi-Attribute Line Graph The Multi-Attribute Line Graph provides a general indication of network activity. The attributes colors represent different statistics. Green represents Load, blue represents the Frame Rate, orange represents the Error Rate, and yellow represents Collisions. You can scroll back in time to view previously logged values for these attributes. For more information, refer to the SPECTRUM System User s Guide. Use the graph properties button to modify the presentation of the graph. It has three options: Scroll to Date-Time sets the viewing area to begin at a specified date and time. Change Time Scale sets the Y axis time scale for the graph. Data Logging data logging is not relevant for the Segment Performance Views of the RMON Probe models. Use the Lin/Log toggle button to toggle between a linear and a logarithmic scale presentation of the graph. Accessing Ethernet Views Viewing Statistics with the Details Button Click the Details button in the Performance View for more diagnostic detail. The Statistics Detail View appears; it presents a graphical breakdown of the frame size distribution and error statistics which are updated and presented as totals or deltas. Note that this view is dynamically updated. The Frame Breakdown pie chart provides a colorcoded view of the network segment s total traffic by frame size, separated into the following categories: Undersize 64 Bytes 65 to 127 Bytes 128 to 255 Bytes 256 to 511 Bytes 512 to 1023 Bytes 1024 to 1518 Bytes Oversized Total Device Management Page 46 RMON/RMON2

47 Using RMON The Error Breakdown pie chart provides a colorcoded view of the network segment s error types (Alignment, Collisions, Fragments, and Jabbers). Click on the Total, Delta, or Accum buttons to modify the data output. Total The parameter s value over this instance s entire interval. Delta The parameter s value over the duration of the update interval. Accum The parameter s value over the interval since the Accum button was selected. Ethernet History From the Icon Subviews menu, click on Ethernet History. The Ethernet History Table presents the RMON History data in tabular form. The RMON History group records data from the Statistics group over user-defined intervals and stores it for later retrieval, allowing you to perform trend analysis of a statistic over time or to isolate periods of time during which a network event may have occurred. Accessing Ethernet Views Configure Control Table View From the Icon Subviews menu for the RMONApp icon, click on Configure RMON. The Configure Control Table view provides button access to the History Control and Host Control Tables, which are described below. History Control Table This table allows you to create new entries into this table. This table provides the following information. Interface Index Enter the interface index that will be added to the History Control table for monitoring purposes. Number of Samples Enter the requested number of discrete time intervals over which data has to be saved. Sample Intervals(sec) Enter the interval in secs over which data has to be sampled. Log values in Database Setting this to start will begin logging attribute values of history table to the SPECTRUM DB. The Create Control Table Entry button launches the above changes. Device Management Page 47 RMON/RMON2

48 Using RMON Accessing Ethernet Views Note: You must save before you launch the Control Table entry. Ethernet History Control Table View Access this view by clicking the View button in the History Control table. This view allows you to view the changes done to the control table. Device Management Page 48 RMON/RMON2

49 Using RMON Accessing Ethernet Views Figure 12: Ethernet History Control Table View Device Management Page 49 RMON/RMON2

50 Using RMON The History Control Table (Figure 12) presents the configuration of each History instance running on the network interface. By default, the RMON standard specifies 2 instances, having intervals of 1800 seconds and 30 seconds. Each instance features the following fields: Data Source Interface being monitored Interval The sample collection interval SizeReq Maximum number of recorded intervals (buckets) requested for the sample Size The number of buckets currently recorded in the sample Owner The person who configured the entry Status The status of the control table entry Note that when the values for SizeReq and Size are identical, the oldest entries in the History Control Table for that instance will be replaced by the newest entries. Viewing the History Table Accessing Ethernet Views Double click any History Control Table entry to display the data for that instance. The History Table shows the past performance measured at the monitored network interface (data source) of the device. Appendix A contains detailed descriptions of the fields found in the History Table. Hosts Control From the Icon Subviews menu, click on Hosts Control. The Hosts Control Table (Figure 12) presents the RMON Host data in tabular form. The RMON Host group provides a breakdown of traffic statistics per network host by using the source and destination MAC address fields contained in a transmitted packet. This allows you to view the statistical data associated with each host and isolate traffic patterns per host, including items such as traffic levels and error levels. Device Management Page 50 RMON/RMON2

51 Using RMON Accessing Ethernet Views Figure 13: Host Control Table View Device Management Page 51 RMON/RMON2

52 Using RMON The Host Control Table presents the configuration of each Host instance running on the network interface. Each instance features the following fields: Data Source The interface being monitored. Size The number of host entries in the table. Last Deleted The time that the oldest entry was deleted and replaced by the newest entry. Owner The individual or entity that configured this entry. Status The status of this control table entry. Accessing Ethernet Views Control section of the Configure Control Table view. Making entries in control tables will require read write access on the device. Viewing the Host Control Table Double click on any instance in the Host Control Table to open the Host Table View. The Host Table, shown in Figure 13, displays per-host traffic statistics measured at the monitored network interface (data source) of the device. Appendix A contains detailed descriptions of the fields found in the Host Table. The number of entries in the table (Size) is allotted dynamically according to the resources available. This means that the oldest entry is deleted and replaced by the newest entry when there is a resource constraint; the time this occurs is indicated by the column Last Deleted. Host Control Table This table allows you to enter in a new host interface. You must provide the Interface Number for which you need to create a Control table entry. Control table entries will be created in the Ethernet Statistics view, Host Control table, and Matrix table. You may view these tables by clicking the View button provided under the Host Device Management Page 52 RMON/RMON2

53 Using RMON Accessing Ethernet Views Figure 14: Host Control Table View Device Management Page 53 RMON/RMON2

54 Using RMON Accessing Ethernet Views Viewing the Host Table Detail Double click on any row in the Host Table to open the Host Table Detail for that MAC address. This screen displays many of the same categories that are found in the Host Table. See Appendix A for more information about this task. Matrix Control Table View From the Icon Subviews menu, click on Matrix Control. The Matrix Control Table presents the RMON Matrix data in tabular form. The RMON Matrix group provides a breakdown of traffic statistics according to the communication pairs it identifies on the segment by using the source and destination MAC address fields contained in a transmitted packet. You can view the statistical data associated with each host pair and isolate traffic patterns between pairs, such as traffic levels, error levels, etc. This information can be useful when characterizing the load distribution of the segment and when designing your network for proper load balance. Device Management Page 54 RMON/RMON2

55 Using RMON Accessing Ethernet Views Figure 15: Matrix Control Table View Device Management Page 55 RMON/RMON2

56 Using RMON Accessing Ethernet Views The Matrix Control Table (Figure 15) presents the configuration of each Matrix instance running on the network interface. For each data source, the Matrix Control Table shows the following items. Data Source The interface being monitored. Size The number of matrix entries in the table Last Deleted The date that the last entry was deleted. Owner The individual or entity that configured the entry. Status The status of this control table entry. Note that size (the number of entries in the table) is allocated dynamically according to the resources available. When there is a resource constraint, the oldest entry is deleted and replaced by the newest entry; the time this occurs is indicated by the column Last Deleted. Viewing the Matrix Table Double click on any instance in the Matrix Control Table to open the Matrix Table View. The Matrix Table View, shown in Figure 16, displays traffic statistics for each host pair, measured at the monitored network interface. Device Management Page 56 RMON/RMON2

57 Using RMON Accessing Ethernet Views Figure 16: Matrix Table View Device Management Page 57 RMON/RMON2

58 Using RMON The following fields appear in the Matrix Table: Source The source MAC address of communications for this pair. Destination The destination MAC address of communications for this pair. Packets The packets transmitted between the communicating hosts. Octets The octets transmitted between the communicating hosts. Errors The errors detected during communications between the hosts. The source-destination table provides a complete cross-reference of source (transmitting) and destination (receiving) devices over the network segment. Note that addresses are translated to reveal the device s manufacturer. Accessing Ethernet Views arbitrary number of hosts on the segment with the greatest value for that parameter. You can specify the number of hosts included in a measurement, as well as the interval over which the measurement is made. Note: You must hit the update button to receive information back from this table. HostTopN Control Access: From the Icon Subviews menu for an RMONEthProbe icon, click on HostTopN Control. The HostTopN Control Table (Figure 17) presents the RMON HostTopN data in tabular form. The RMON HostTopN group allows you to select one of the seven Host group statistics and determine an Device Management Page 58 RMON/RMON2

59 Using RMON Accessing Ethernet Views Figure 17: HostTopN Control Table View Device Management Page 59 RMON/RMON2

60 Using RMON The HostTopN Control Table presents the configuration of each HostTopN instance running on the network interface. Fields for each data source include these items: Data Source The interface being monitored. Report The Host group statistic on which to perform the measurement. Accessing Ethernet Views the measurement parameters and view the results of the completed sample. Use this view to determine (for example) which hosts are generating the most traffic, which are receiving the most traffic (in either packets or bytes), and which are generating the largest number of errors. ReqSize The number of hosts requested for this HostTopN measurement. Size The number of hosts detected during the measurement interval. Duration The interval in seconds requested for this HostTopN measurement. Started The time this measurement interval started collecting data. Time Left The number of seconds left in the measurement interval. Owner The entity that configured this entry. Viewing or Configuring the Top Hosts To configure an instance of Top Hosts or to view the result of an instance or one in progress, double click on an instance listed in the HostTopN Control Table. The Top Hosts view (shown in Figure 18) appears, where you specify Device Management Page 60 RMON/RMON2

61 Using RMON Accessing Ethernet Views Figure 18: Top Hosts View Device Management Page 61 RMON/RMON2

62 Using RMON In the dialog box, enter the number of hosts to be included in the sample (Top hosts) and the duration of the sample (Time Left in Sample). Press Return and click OK in the Save Changes dialog box. The Top Hosts dialog box counts down the time left in the sample (Sample Interval) and notes the statistic being monitored (Report Type). Click Update to see the results, which are listed below the Top Hosts dialog box. RMON Capture Packet View Access: From Icon Subviews menu for the RMONApp icon, select RMON Packet Capture. The Packet Capture group allows packets to be captured after they flow through a channel. This group consists of the Buffer Control view and the and the Control Table, and requires the implementation of the filter group. You may also enter a new buffer into the buffer table by accessing the New Buffer view, which uses the same fields as the Buffer Control view. The Buffer Control view also provides button access to the Channel Table view. Buffer Control View RMON Capture Packet View This view provides a set of parameters that control the collection of a stream of packets that have matched filters. This view provides following information. CntrlIndex An index that identifies the channel that is the source of packets for this Buffer Control table. The channel identified by a particular value of this index is the same as identified by the same value of the Channel Index field. DataSource Identifies the source of the data that the associated function is configured to analyze. This source can be added to any interface on this device. FullStatus Shows whether the buffer has room to accept new packets or if it is full. If the status is spaceavailable, the buffer is accepting new packets normally. If the status is full and the associated FullAction field is wrapwhenfull, the buffer is accepting new packets by deleting enough of the oldest packets to make room for new ones as they arrive. Otherwise, if the status is full and the FullAction field is lockwhenfull, then the buffer has stopped collecting packets. Device Management Page 62 RMON/RMON2

63 Using RMON When this field is set to full the probe must not later set it to spaceavailable except in the case of a significant gain in resources such as an increase of MaxOctsGrantd field. FullAction Controls the action of the buffer when it reaches the full status. When in the lockwhenfull state and a packet is added to the buffer that fills the buffer, FullStatus field will be set to full and this buffer will stop capturing packets. CaptSliceSz Maximum number of octets of each packet that will be saved in this capture buffer. For example, if a 1500 octet packet is received by the probe and this field is set to 500, then only 500 octets of the packet will be stored in the associated capture buffer. If this variable is set to 0, the capture buffer will save as many octets as is possible. This field may not be modified if the associated Status field is equal to valid. DnloadSliceSz Maximum number of octets of each packet in this capture buffer that will be returned in an SNMP retrieval of that packet. DnloadOffset The offset of the first octet of each packet in this capture buffer that will be returned in an SNMP RMON Capture Packet View retrieval of that packet. For example, if 500 octets of a packet have been stored in the associated capture buffer and this field is set to 100, then the CaptPkts field that contains the packet will contain bytes starting 100 octets into the packet. MaxOctReqd Requested maximum number of octets to be saved in this capturebuffer, including any implementation specific overhead. If this variable is set to -1, the capture buffer will save as many octets as is possible. When this field is created or modified, the probe should set MaxOctsGrantd as closely to this field as is possible for the particular probe implementation and available resources. MaxOctsGrantd Maximum number of octets that can be saved in this capture buffer, including overhead. If this variable is -1, the capture buffer will save as many octets as possible. When the MaxOctsReqd field is created or modified, the probe should set this field as closely to the requested value as is possible for the particular probe implementation and available resources. However, if the request field has the special value of -1, the probe must set this field to -1. The probe must not lower this value except as a result of a modification to the associated MaxOctsReqd field. When this maximum number of octets is reached and a new Device Management Page 63 RMON/RMON2

64 Using RMON packet is to be added to this capture buffer and the corresponding FullAction is set to wrapwhenfull, enough of the oldest packets associated with this capture buffer shall be deleted by the agent so that the new packet can be added. If the corresponding FullAction is set to lockwhenfull, the new packet shall be discarded. In either case, the probe must set FullStatus to full. When the value of this field changes to a value less than the current value, entries are deleted from the Buffer table associated with this buffercontrolentry. Enough of the oldest of these capturebufferentries shall be deleted by the agent so that the number of octets used remains less than or equal to the new value of this field. CaptPkts Number of packets currently in this Capture Buffer. TurnOnTime The value of sysuptime when this Capture Buffer was first turned on. Owner The entity that configured this entry and is therefore using the resources assigned to it. Status The status of this Buffer Control entry. The Control Table RMON Capture Packet View This table also provides button access to the New Filter view. This view contains the following information. Channel Index An index that uniquely identifies an entry in the channel table. Each such entry defines one channel, a logical data, and an event stream. It is suggested that before creating a channel, an application should scan all instances of the Channel Index field to make sure that there are no pre-existing filters that would be inadvertently linked to the channel. DataSource Identifies the source of the data that the associated function is configured to analyze. This source can be added to any interface on this device. AcceptType Controls the action of the filters associated with this channel. If this field is equal to acceptmatched, packets will be accepted to this channel if they are accepted by both the packet data and packet status matches of an associated filter. If this field is equal to acceptfailed, packets will be accepted to this channel only if they fail either the packet data match or the Device Management Page 64 RMON/RMON2

65 Using RMON packet status match of each of the associated filters. In particular, a channel with no associated filters will match no packets if set to acceptmatched and will match all packets in the acceptfailed. This field may not be modified if the associated channelstatus field is equal to valid. Datacontrol Controls the flow of data through this channel. If this field is on, data, or status, events flow through this channel. If this field is equal to off, events will not flow through this channel. OnEvntIndex Identifies the event that is configured to turn the associated Data Control field from off to on when the event is generated. The event identified by a particular value of this field is the same event as identified by the same value of the EvntIndex field. If there is no corresponding entry in the Event table, then no association exists. In fact, if no event is intended for this channel, OnEvntIndex must be set to zero, a non-existent event index. This field may not be modified if the associated channelstatus field is equal to valid. OffEvntIndex Identifies the event that is configured to turn the associated Data Control field from on to off when the event is generated. The event identified by a RMON Capture Packet View particular value of this field is the same event as identified by the same value of the EvntIndex field. If there is no corresponding entry in the Event table, then no association exists. In fact, if no event is intended for this channel, OffEventIndex must be set to zero, a nonexistent event index. This field may not be modified if the associated Status field is equal to valid. EvntIndex Identifies the event that is configured to be generated when the associated Data Control is on and a packet is matched. The event identified by a particular value of this field is the same event as identified by the same value of the EvntIndex field. If there is no corresponding entry in the Event table, then no association exists. In fact, if no event is intended for this channel, EvntIndex must be set to zero, a nonexistent event index. This field may not be modified if the associated EvntStatus field is equal to valid. EvntStatus The event status of this channel. If this channel is configured to generate events when packets are matched, a means of controlling the flow of those events is often needed. When this field is equal to eventready, a single event may be generated, after which this field will be set by the probe to Device Management Page 65 RMON/RMON2

66 Using RMON eventfired. While in the eventfired state, no events will be generated until the field is modified to eventready (or eventalwaysready). The management station can thus easily respond to a notification of an event by re-enabling this field. If the management station wishes to disable this flow control and allow events to be generated at will, this field may be set to eventalwaysready. Disabling the flow control is discouraged as it can result in high networktraffic or other performance problems. Matches The number of times this channel has matched a packet. Note that this field is updated even when Data Control is set to off. Description A comment describing this channel. Owner The entity that configured this entry and is therefore using the resources assigned to it. Status The status of this channel entry. New Filter Table View The Filter group allows packets to be captured with an arbitrary filter expression. A logical data and event stream or channel is formed by the RMON Capture Packet View packets that match the filter expression. This filter mechanism allows the creation of an arbitrary logical expression with which to filter packets. Each filter associated with a channel is OR'ed with the others. Within a filter, any bits checked in the data and status are AND'ed with respect to other bits in the same filter. The NotMask also allows for checking for inequality. Finally, the AcceptType field allows for inversion of the whole equation. If a management station wishes to receive a trap to alert it that new packets have been captured and are available for download, it is recommended that it set up an alarm entry that monitors the value of the relevant Matches instance. The channel can be turned on or off, and can also generate events when packets pass through it. This view contains the following information. Index An index that uniquely identifies an entry in the filter table. Each such entry defines one filter that is to be applied to every packet received on an interface. Channel Index Identifies the channel of which this filter is a part. The filters identified by a particular value of this field are associated with the same channel as Device Management Page 66 RMON/RMON2

67 Using RMON identified by the same value of the Channel Index field. Status The status of this filter entry. Owner The entity that configured this entry and is therefore using the resources assigned to it. PacketData Data that is to be matched with the input packet. For each packet received, this filter and the accompanying PktDataMask and PktDataNotMask fields will be adjusted for the offset. The only bits relevant to this match algorithm are those that have the corresponding PktDataMask bit equal to one. The following three rules are then applied to every packet: 1 If the packet is too short and does not have data corresponding to part of the PacketData, the packet will fail this data match. 2 For each relevant bit from the packet with the corresponding PktDataNotMask bit set to zero, if the bit from the packet is not equal to the corresponding bit from the PacketData, then the packet will fail this data match. 3 If for every relevant bit from the packet with the corresponding PktDataNotMask bit set to one, the bit from the packet is equal to the RMON Capture Packet View corresponding bit from the PacketData, then the packet will fail this data match. Any packets that have not failed any of the three matches above have passed this data match. In particular, a zero length filter will match any packet. This field may not be modified if the associated Status field is equal to valid. PktDataOffset The offset from the beginning of each packet where a match of packet data will be attempted. This offset is measured from the point in the physical layer packet after the framing bits, if any. For example, in an Ethernet frame, this point is at the beginning of the destination MAC address. PktDataMask The mask that is applied to the match process. After adjusting this mask for the offset, only those bits in the received packet that correspond to bits set in this mask are relevant for further processing by the match algorithm. The offset is applied to PktDataMask in the same way it is applied to the filter. For the purposes of the matching algorithm, if the associated PktData field is longer than this mask, this mask is conceptually extended with '1' bits until it reaches the length of the PktData field. This field may not Device Management Page 67 RMON/RMON2

68 Using RMON be modified if the associated Status field is equal to valid. PktDataNotMask The inversion mask that is applied to the match process. After adjusting this mask for the offset, those relevant bits in the received packet that correspond to bits cleared in this mask must all be equal to their corresponding bits in the PktData field for the packet to be accepted. In addition, at least one of those relevant bits in the received packet that correspond to bits set in this mask must be different than its corresponding bit in the PktData field. For the purposes of the matching algorithm, if the associated PktData field is longer than this mask, this mask is conceptually extended with '0' bits until it reaches the length of the PktData field. This field may not be modified if the associated Status field is equal to valid. PacketStatus The status that is to be matched with the input packet. The only bits relevant to this match algorithm are those that have the corresponding PktStatusMask bit equal to one. For each relevant bit from the packet status with the corresponding PktStatusNotMask bit set to zero, if the bit from the packet status is not equal to the corresponding bit from the PktStatus, then the packet will fail this status match. If for every RMON Capture Packet View relevant bit from the packet status with the corresponding PktStatusNotMask bit set to one, the bit from the packet status is equal to the corresponding bit from the PktStatus, then the packet will fail this status match. Any packets that have not failed either of the two matches above have passed this status match. In particular, a zero length status filter will match any packet's status. The value of the packet status is a sum. This sum initially takes the value zero. Then, for each error, E, that has been discovered in this packet, 2 raised to a value representing E is added to the sum. The errors and the bits that represent them are dependent on the media type of the interface that this channel is receiving packets from. For example, an Ethernet fragment would have a value of 6 (2^1 + 2^2). As this MIB is expanded to new media types, this field will have other mediaspecific errors defined. PktStatusMask The mask that is applied to the status match process. Only those bits in the received packet that correspond to bits set in this mask are relevant for further processing by the status match algorithm. For the purposes of the matching algorithm, if the associated PktStatus field is longer than this mask, this mask is conceptually extended with '1' bits until it reaches Device Management Page 68 RMON/RMON2

69 Using RMON the size of the PktStatus. In addition, if a packet status is longer than this mask, this mask is conceptually extended with '0' bits until it reaches the size of the packet status. This field may not be modified if the associated Filter Status field is equal to valid. PktStatusNoMask Inversion mask that is applied to the status match process. Those relevant bits in the received packet status that correspond to bits cleared in this mask must all be equal to their corresponding bits in the PktStatus field for the packet to be accepted. In addition, at least one of those relevant bits in the received packet status that correspond to bits set in this mask must be different to its corresponding bit in the PktStatus field for the packet to be accepted. For the purposes of the matching algorithm, if the associated PktStatus field or a packet status is longer than this mask, this mask is conceptually extended with '0' bits until it reaches the longer of the lengths of the PktStatus field and the packet status. Protocol Distribution (RMONII) Protocol Distribution (RMONII) This view also provides access to the Protocol Directory Table and the Protocol Statistics view described later in this section. Protocol Distribution Table This view provides the following information. Data Source Identifies the source of the data that the associated function is configured to analyze. This source can be added to any interface on this device. DroppedFram Displays the last dropped frame. CreateTime Displays any field that stores the last time its entry was created. Owner Identifies the source of the data that the associated function is configured to analyze. Status Status of this protocol entry. Device Management Page 69 RMON/RMON2

70 Using RMON Protocol Directory Table Local Index The locally arbitrary, but unique identifier associated with the ID. Description Describes the protocol encapsulation. A probe may choose to describe only a subset of the entire encapsulation (e.g., only the highest layer). This field may not be modified if the associated Protocol Status field is equal to active. Type Describes two attributes of this protocol directory entry. Note that when an entry is created, the agent will supply values for the bits that match the capabilities of the agent with respect to this protocol. Note that since row creations usually exercise the limited extensibility feature, these bits will usually be set to zero. AddrMapConfig Describes and configures the probe's support for address mapping for this protocol. When the probe creates entries in this table for all protocols that it understands, it will set the entry to notsupported if it doesn't have the capability to perform address mapping for the protocol or if this protocol is not a network-layer protocol. When an entry is created in this table by a Protocol Distribution (RMONII) management operation as part of the limited extensibility feature, the probe must set this value to notsupported, because limited extensibility of the Protocol Directory table does not extend to interpreting addresses of the extended protocols. Host Config Describes and configures the probe's support for the network layer and application layer host tables for this protocol. When the probe creates entries in this table for all protocols that it understands, it will set the entry to notsupported if it doesn't have the capability to track the Host table for this protocol or if the Host table is implemented but doesn't have the capability to track this protocol. Note that if the Host table is implemented, the probe may only support a protocol if it is supported in both the Host table and the Host table. Matrix Describes and configures the probe's support for the network layer and application layer matrix tables for this protocol. When the probe creates entries in this table for all protocols that it understands, it will set the entry to notsupported if it doesn't have the capability to track the Matrix tables for this protocol or if the Matrix tables are implemented but don't have the capability to track this protocol. Note that if the Matrix tables Device Management Page 70 RMON/RMON2

71 Using RMON are implemented, the probe may only support a protocol if it is supported in both of the Matrix tables. Protocol Statistics View An entry is made in this table for every protocol in the Protocol Distribution table that has been seen in at least one packet. Counters are updated in this table for every protocol type that is encountered when parsing a packet, but no counters are updated for packets with MAC-layer errors. Note that if a Protocol Distribution entry is deleted, all associated entries in this table are removed. DirLocalIndex This Index is composed of the Protocol Distribution Control Index of the associated Protocol Distribution Control entry followed by the Local Index of the associated protocol that this entry represents. An example of the indexing of this entry is DistStatsPkts Packets Number of packets without errors received of this protocol type. Note that this is the number of linklayer packets, so if a single network-layer packet is fragmented into several link-layer frames, this counter is incremented several times. Address Map Control View (RMONII) Octets Number of octets in packets received of this protocol type since it was added to the DistStatsTable (excluding framing bits but including FCS octets), except for those octets in packets that contained errors. Note this doesn't count just those octets in the particular protocol frames, but includes the entire packet that contained the protocol. Address Map Control View (RMONII) Access: From the Icon Subviews menu for an RMONEthProbe icon, click on Address Map. This view lists MAC address to network address bindings discovered by the probe and what interface they were last seen on. This view provides the following information. Data Source The source of data for this Address Map Control entry. Dropped Frame Total number of frames which were received by the probe and therefore not accounted for in the StatsDropEvents, but for which the probe chose not to count for this entry for whatever reason. Device Management Page 71 RMON/RMON2

72 Using RMON Most often, this event occurs when the probe is out of some resources and decides to shed load from this collection. This count does not include packets that were not counted because they had MAC-layer errors. Note that, unlike the dropevents counter, this number is the exact number of frames dropped. Owner The entity that configured this entry and is therefore using the resources assigned to it. Status The status of this Address Map Control entry. An entry may not exist in the active state unless all fields in the entry have an appropriate value. If this field is not equal to active, all associated entries in the Address Map table shall be deleted. Inserts The number of times an address mapping entry has been inserted into the address map table. If an entry is inserted, then deleted, and then inserted, this counter will be incremented by 2. Note that the table size can be determined by subtracting Deletes from Inserts. Deletes The number of times an address mapping entry has been deleted from the address map table (for Address Map Control View (RMONII) any reason). If an entry is deleted, then inserted, and then deleted, this counter will be incremented by 2. Note that the table size can be determined by subtracting Deletes from Inserts. Max Entries The maximum number of entries that are desired in the address map table. The probe will not create more than this number of entries in the table, but may choose to create fewer entries in this table for any reason including the lack of resources. If this is set to a value less than the current number of entries, enough entries are chosen in an implementation-dependent manner and deleted so that the number of entries in the table equals the value of this field. If this value is set to -1, the probe may create any number of entries in this table. This value may be used to control how resources are allocated on the probe for the various RMON functions. Address Map Table A table of network layer address to physical address to interface mappings. The probe will add entries to this table based on the source MAC and network addresses seen in packets without MAClevel errors. The probe will populate this table for all protocols in the protocol directory table whose value of AddrMapConfig is equal to supportedon, and will delete any entries whose Device Management Page 72 RMON/RMON2

73 Using RMON protocoldirentry is deleted or has a AddrMapConfig value of supportedoff. N/W Addr The network address for this relation. This is represented as an octet string with specific semantics and length as identified by the Protocol Directory Local Index component of the index. For example, if the Protocol Directory Local Index indicates an encapsulation of ip, this field is encoded as a length octet of 4, followed by the 4 octets of the ip address, in network byte order. Physical Address. The last source physical address on which the associated network address was seen. If the protocol of the associated network address was encapsulated inside of a network-level or higher protocol, this will be the address of the next-lower protocol with the addressrecognitioncapable bit enabled and will be formatted as specified for that protocol. Source The interface or port on which the associated network address was most recently seen. If this address mapping was discovered on an interface, this field shall identify the instance of the ifindex field, defined in [3,5], for the desired interface. For example, if an entry were to receive data from interface #1, this field would be set to ifindex.1. Network Layer (RMONII) If this address mapping was discovered on a port, this field shall identify the instance of the rptrgroupport Index field, defined in [RFC1516], for the desired port. For example, if an entry were to receive data from group #1, port #1, this field would be set to rptrgroupportindex.1.1. Note that while the Source field associated with this entry may only point to index fields, this field may at times point to repeater port fields. This situation occurs when the Source field points to an interface which is a locally attached repeater and the agent has additional information about the source port of traffic seen on that repeater. Last change The value of sysuptime at the time this entry was last created or the values of the physical address changed. This can be used to help detect duplicate address problems, in which case this field will be updated frequently.7 Network Layer (RMONII) Counts the amount of traffic sent from and to each network address discovered by the probe. Note that while the Host Control table also has fields that control an optional Host table, implementation of the Host table is not required to fully implement this group. Device Management Page 73 RMON/RMON2

74 Using RMON Data Source The source of data for the associated host tables. The statistics in this group reflect all packets on the local network segment attached to the identified interface. This field may not be modified if the associated Host Control Status field is equal to active. N1 Data Frames Total number of frames which were received by the probe and therefore not accounted for in the StatsDropEvents, but for which the probe chose not to count for the associated Host table entries for whatever reason. Most often, this event occurs when the probe is out of some resources and decides to shed load from this collection. This count does not include packets that were not counted because they had MAC-layer errors. Note that if the Host table is inactive because no protocols are enabled in the protocol directory, this value should be 0. Note that, unlike the dropevents counter, this number is the exact number of frames dropped. N1 Inserts The number of times a Host entry has been inserted into the Host table. If an entry is inserted, then deleted, and then inserted, this counter will be incremented by 2. Network Layer (RMONII) To allow for efficient implementation strategies, agents may delay updating this field for short periods of time. For example, an implementation strategy may allow internal data structures to differ from those visible via SNMP for short periods of time. This counter may reflect the internal data structures for those short periods of time. Note that the table size can be determined by subtracting Nl Deletes from Nl Inserts. N1 Delete Number of times a Host entry has been deleted from the Host table (for any reason). If an entry is deleted, then inserted, and then deleted, this counter will be incremented by 2. To allow for efficient implementation strategies, agents may delay updating this field for short periods of time. For example, an implementation strategy may allow internal data structures to differ from those visible via SNMP for short periods of time. This counter may reflect the internal data structures for those short periods of time. Note that the table size can be determined by subtracting Nl Deletes from Nl Inserts. N1n MaxDesired Entries Maximum number of entries that are desired in the Host table on behalf of this control entry. The probe will not create more than this number of Device Management Page 74 RMON/RMON2

75 Using RMON associated entries in the table, but may choose to create fewer entries in this table for any reason including the lack of resources. If this field is set to a value less than the current number of entries, enough entries are chosen in an implementation-dependent manner and deleted so that the number of entries in the table equals the value of this field. If this value is set to -1, the probe may create any number of entries in this table. If the associated Status field is equal to active, this field may not be modified. This field may be used to control how resources are allocated on the probe for the various RMON functions. A1 DroppedFrames Total number of frames which were received by the probe and therefore not accounted for in the StatsDropEvents, but for which the probe chose not to count for the associated Host entries for whatever reason. Most often, this event occurs when the probe is out of some resources and decides to shed load from this collection. This count does not include packets that were not counted because they had MAC-layer errors. Note that if the Host table is not implemented or is inactive because no protocols are enabled in the protocol directory, this value should be 0. Note that, unlike the dropevents counter, this number is the exact number of frames dropped. Network Layer (RMONII) A1 Inserts Number of times an Host entry has been inserted into the Host table. If an entry is inserted, then deleted, and then inserted, this counter will be incremented by 2. To allow for efficient implementation strategies, agents may delay updating this field for short periods of time. For example, an implementation strategy may allow internal data structures to differ from those visible via SNMP for short periods of time. This counter may reflect the internal data structures for those short periods of time. Note that the table size can be determined by subtracting Al Deletes from Al Inserts. A1 Deletes Number of times an Host entry has been deleted from the Host table (for any reason). If an entry is deleted, then inserted, and then deleted, this counter will be incremented by 2. To allow for efficient implementation strategies, agents may delay updating this field for short periods of time. For example, an implementation strategy may allow internal data structures to differ from those visible via SNMP for short periods of time. This counter may reflect the internal data structures for those short periods of time. Note that the table size can be determined by subtracting Al Deletes from Al Inserts. Device Management Page 75 RMON/RMON2

76 Using RMON A1 MaxDesired Entries Maximum number of entries that are desired in the Host table on behalf of this control entry. The probe will not create more than this number of associated entries in the table, but may choose to create fewer entries in this table for any reason including the lack of resources. If this field is set to a value less than the current number of entries, enough entries are chosen in an implementation-dependent manner and deleted so that the number of entries in the table equals the value of this field. If this value is set to -1, the probe may create any number of entries in this table. If the associated Status field is equal to `active', this field may not be modified. This field may be used to control how resources are allocated on the probe for the various RMON functions. Owner The entity that configured this entry and is therefore using the resources assigned to it. Status The status of this Host Control entry. An entry may not exist in the active state unless all fields in the entry have an appropriate value. If this field Network Layer (RMONII) is not equal to active, all associated entries in the Host table shall be deleted. Network Host Table A collection of statistics for a particular network layer address that has been discovered on an interface of this device. The probe will populate this table for all network layer protocols in the Protocol Directory table whose value of Protocol Host Config field is equal to supportedon, and will delete any entries whose Protocol Directory entry is deleted or has a Protocol Host Config value of supportedoff. The probe will add to this table all addresses seen as the source or destination address in all packets with no MAC errors, and will increment octet and packet counts in the table for all packets with no MAC errors. This table provides the following information. N/w Addr Network address for this Host entry. This is represented as an octet string with specific semantics and length as identified by the Protocol Local Index component of the index. For example, if the Protocol Local Index indicates an encapsulation of ip, this field is encoded as a Device Management Page 76 RMON/RMON2

77 Using RMON length octet of 4, followed by the 4 octets of the ip address, in network byte order. In Pkts Number of packets without errors transmitted to this address since it was added to the Host table. Note that this is the number of link-layer packets, so if a single network-layer packet is fragmented into several link-layer frames, this counter is incremented several times. Out Pkts Number of packets without errors transmitted by this address since it was added to the Host table. Note that this is the number of link-layer packets, so if a single network-layer packet is fragmented into several link-layer frames, this counter is incremented several times. In Octets Number of octets transmitted to this address since it was added to the Host table (excluding framing bits but including FCS octets), excluding those octets in packets that contained errors. Note this doesn't count just those octets in the particular protocol frames, but includes the entire packet that contained the protocol. Out Octets Number of octets transmitted by this address since it was added to the Host table (excluding Network Layer (RMONII) framing bits but including FCS octets), excluding those octets in packets that contained errors. Note this doesn't count just those octets in the particular protocol frames, but includes the entire packet that contained the protocol. OutNonMacUnicastPkts Number of packets without errors transmitted by this address that were directed to any MAC broadcast addresses or to any MAC multicast addresses since this host was added to the Host table. Note that this is the number of link-layer packets, so if a single network-layer packet is fragmented into several link-layer frames, this counter is incremented several times. Create Time The value of sysuptime when this entry was last activated. This can be used by the management station to ensure that the entry has not been deleted and recreated between polls. Matrix TopN Control Table The number of packets without errors transmitted by this address that were directed to any MAC broadcast addresses or to any MAC multicast addresses since this host was added to the Host table. Note that this is the number of link-layer packets, so if a single network-layer Device Management Page 77 RMON/RMON2

78 Using RMON packet is fragmented into several link-layer frames, this counter is incremented several times. This table contains the following information. Matrix Index An index that uniquely identifies an entry in the Matrix TopN Control table. Each such entry defines a function that discovers conversations on a particular interface and places statistics about them in the Matrix Source Destination (SD) table and the Matrix Destination Source (DS) table. Rate Base The variable for each Matrix (SD/DS) entry that the Matrix TopN table entries are sorted by. This field may not be modified if the associated Status field is equal to active. Time Remaining Number of seconds left in the report currently being collected. When this field is modified by the management station, a new collection is started, possibly aborting a currently running report. The new value is used as the requested duration of this report, and is immediately loaded into the associated Duration field. When the report finishes, the probe will automatically start another collection with the same initial value of Time Remaining field. Thus the management station may simply read the resulting reports repeatedly, checking the start time and duration Network Layer (RMONII) each time to ensure that a report was not missed or that the report parameters were not changed. While the value of this field is non-zero, it decrements by one per second until it reaches zero. At the time that this field decrements to zero, the report is made accessible in the Matrix TopN Control table, overwriting any report that may be there. When this field is modified by the management station, any associated entries in the Matrix TopN Control table shall be deleted. (Note that this is a different algorithm than the one used in the Host TopN table). Gen Requests Number of reports that have been generated by this entry. Duration Number of seconds that this report has collected during the last sampling interval. When the associated Time Remaining field is set, this field shall be set by the probe to the same value and shall not be modified until the next time the Time Remaining field is set. This value shall be zero if no reports have been requested for this Matrix TopN Control entry. Device Management Page 78 RMON/RMON2

79 Using RMON Requested Size Maximum number of matrix entries requested for this report. When this field is created or modified, the probe should set the Granted Size as closely to this field as is possible for the particular probe implementation and available resources. Granted Size Maximum number of matrix entries in this report. When the associated Requested Size field is created or modified, the probe should set this field as closely to the requested value as is possible for the particular implementation and available resources. The probe must not lower this value except as a result of a set to the associated Requested Size field. If the value of Rate Base field is equal to MatrixTopNPkts, when the next TopN report is generated, matrix entries with the highest value of PktRate shall be placed in this table in decreasing order of this rate until there is no more room or until there are no more matrix entries. If the value of the Rate Base field is equal to Matrix TopN Octets, when the next TopN report is generated, matrix entries with the highest value of Matrix TopN OctetRate shall be placed in this table in decreasing order of this rate until there is no more room or until there are no more matrix Network Layer (RMONII) entries. It is an implementation-specific matter how entries with the same value of Matrix TopN PktRate or Matrix TopN OctetRate are sorted. It is also an implementation-specific matter as to whether or not zero-valued entries are available. Start Time Value of sysuptime when this TopN report was last started. In other words, this is the time that the associated Time Remaining field was modified to start the requested report or the time the report was last automatically (re)started. This field may be used by the management station to determine if a report was missed or not. Owner The entity that configured this entry and is therefore using the resources assigned to it. Status The status of this Matrix TopN Control entry. An entry may not exist in the active state unless all fields in the entry have an appropriate value. If this field is not equal to active, all associated entries in the Matrix TopN table shall be deleted by the agent. Traffic Table A list of traffic matrix entries that collect statistics for conversations between two network-level Device Management Page 79 RMON/RMON2

80 Using RMON addresses. This table is indexed first by the destination address and then by the source address to make it convenient to collect all conversations to a particular address. The probe will populate this table for all network layer protocols in the protocol directory table whose value of Matrix Config is equal to supportedon, and will delete any entries whose Protocol Directory entry is deleted or has a Protocol Matrix Config value of supportedoff. The probe will add to this table all pairs of addresses seen in all packets with no MAC errors, and will increment an octet and packet counts in the table for all packets with no MAC errors. Further, this table will only contain entries that have a corresponding entry in the Matrix Source Destination table with the same source address and destination address. There are two separated tables in this view, The Destination Source table and the Source Destination table. These tables contain the following information. Destination Source Table Dest Addr The network destination address for this Matrix Destination Address entry. This is represented as Network Layer (RMONII) an octet string with specific semantics and length as identified by the Local Index component of the index. For example, if the Protocol Directory Local Index field indicates an encapsulation of ip, this field is encoded as a length octet of 4, followed by the 4 octets of the ip address, in network byte order. Source Addr The network source address for this Matrix Destination Source entry. This is represented as an octet string with specific semantics and length as identified by the Protocol Directory Local Index component of the index. For example, if the Local Index fields indicates an encapsulation of ip, this field is encoded as a length octet of 4, followed by the 4 octets of the ip address, in network byte order. DS Pkts The number of packets without errors transmitted from the source address to the destination address since this entry was added to the Matrix Destination Source table. Note that this is the number of link-layer packets, so if a single network-layer packet is fragmented into several link-layer frames, this counter is incremented several times. Device Management Page 80 RMON/RMON2

81 Using RMON DS Octets The number of octets transmitted from the source address to the destination address since this entry was added to the Matrix Destination Source table (excluding framing bits but including FCS octets), excluding those octets in packets that contained errors. Note this doesn't count just those octets in the particular protocol frames, but includes the entire packet that contained the protocol. DS CreateTime The value of sysuptime when this entry was last activated. This can be used by the management station to ensure that the entry has not been deleted and recreated between polls. Source Destination Table A list of traffic matrix entries which collect statistics for conversations between two networklevel addresses. This table is indexed first by the source address and then by the destination address to make it convenient to collect all conversations from a particular address. The probe will populate this table for all network layer protocols in the protocol directory table whose value of Protocol Directory Matrix Config is equal to supportedon, and will delete any entries whose Protocol Directory entry is deleted or has a Protocol Matrix Config value of supportedoff. Network Layer (RMONII) Source Addr The network source address for this Matrix Source Destination entry. This is represented as an octet string with specific semantics and length as identified by the Protocol Directory Local Index component of the index. For example, if the Local Index indicates an encapsulation of ip, this field is encoded as a length octet of 4, followed by the 4 octets of the ip address, in network byte order. Dest Addr The network destination address for this Matrix Source Destination entry. This is represented as an octet string with specific semantics and length as identified by the Protocol Directory Local Index component of the index. For example, if the Protocol Directory Local Index indicates an encapsulation of ip, this field is encoded as a length octet of 4, followed by the 4 octets of the ip address, in network byte order. SD Pkts The number of packets without errors transmitted from the source address to the destination address since this entry was added to the Matrix Source Destination table. Note that this is the number of link-layer packets, so if a single network-layer packet is fragmented into several link-layer frames, this counter is incremented several times. Device Management Page 81 RMON/RMON2

82 Using RMON SD Octets The number of octets transmitted from the source address to the destination address since this entry was added to the Matrix Source Destination table (excluding framing bits but including FCS octets), excluding those octets in packets that contained errors. Note this doesn't count just those octets in the particular protocol frames, but includes the entire packet that contained the protocol. SD CreateTime The value of sysuptime when this entry was last activated. This can be used by the management station to ensure that the entry has not been deleted and recreated between polls. Matrix TopN Table Local Index The Local Index of the network layer protocol of this entry's network address. Source Address The network layer address of the source host in this conversation. This is represented as an octet string with specific semantics and length as identified by the associated Local Index field. For example, if the Local Index indicates an encapsulation of ip, this field is encoded as a Network Layer (RMONII) length octet of 4, followed by the 4 octets of the ip address, in network byte order. Dest Addres The network layer address of the destination host in this conversation. This is represented as an octet string with specific semantics and length as identified by the associated Local Index field. For example, if the Local Index indicates an encapsulation of ip, this field is encoded as a length octet of 4, followed by the 4 octets of the ip address, in network byte order. Pkt Rate The number of packets seen from the source host to the destination host during this sampling interval, counted using the rules for counting the Matrix SDPkts field. If the value of Matrix TopN Control RateBase is Matrix TopN Pkts, this variable will be used to sort this report. Reverse Packet Rate The number of packets seen from the destination host to the source host during this sampling interval, counted using the rules for counting the SDPkts field (note that the corresponding SDPkts field selected is the one whose source address is equal to the DestAddress field and whose destination address is equal to SourceAddress.) Note that if the value of Matrix TopN Control RateBase is equal to Matrix TopN Pkts, the sort Device Management Page 82 RMON/RMON2

83 Using RMON of TopN entries is based entirely on Matrix TopN PktRate, and not on the value of this field. Octet Rate The number of octets seen from the source host to the destination host during this sampling interval, counted using the rules for counting the SDOctets field. If the value of Matrix TopN Control RateBase is Matrix TopN Octets, this variable will be used to sort this report. ReverseOctetRate The number of octets seen from the destination host to the source host during this sampling interval, counted using the rules for counting the DSOctets field (note that the corresponding SDOctets field selected is the one whose source address is equal to DestAddress and whose destination address is equal to SourceAddress. Note that if the value of Matrix TopN Control RateBase is equal to Matrix TopN Octets, the sort of TopN entries is based entirely on OctetRate, and not on the value of this field. Accessing Token Ring Views only Application Layer protocols are counted. It means that protocols up to and including the Application Layer are supported. Accessing Token Ring Views The following sections describe RMON views that appear on Token Ring icons. Refer to Appendix B, for detailed descriptions of statistics that appear in Token Ring views. Mac-Layer Statistics From the Icon Subviews menu, click on Mac- Layer Statistics. The Mac-Layer Statistics Table (Figure 19) presents the RMON statistics in tabular form. Application Layer The Application Layer host, matrix and matrixtopn functions report on protocol usage at the network layer and higher. Note that the use of the term Application Layer does not imply that Device Management Page 83 RMON/RMON2

84 Using RMON Accessing Token Ring Views Figure 19: Mac-Layer Statistics Table The RMON Statistics group consists of the following 7 parameters measured at the monitored network interface (data source) of the device. These statistics take the form of free running counters that start from zero when a valid instance is created Data Source The interface being monitored. Octets Total octets of data in MAC packets (excluding those that were not good frames) received on the network. Packets Total MAC packets (excluding packets that were not good frames) received. BeaconPkts Total beacon MAC packets detected by the probe. ClaimPkts Total claim token MAC packets detected by the probe. PurgePkts Total ring purge MAC packets detected by the probe. Owner The entity that configured this entry. DropEvnts Total number of times the ring enters a beaconing state during this sampling interval. Device Management Page 84 RMON/RMON2

85 Using RMON Viewing Performance Statistics on the Segment Double click on any instance (row or interface) in the Mac-Layer Statistics Table to view the RMON data presented in SPECTRUM Performance View format. This allows you to view current percentage calculations and a time graph of the interface activity, rather than the absolute numbers of the Statistics Table. Note that this view is dynamically updated. Viewing Network Activity With the Multi-Attribute Line Graph The Multi-Attribute Line Graph provides a general indication of network activity. The attributes colors represent different statistics. Green represents Load, blue represents the Frame Rate, orange represents the error rate. You can scroll back in time to view previously logged values for these attributes. For more information, refer to the SPECTRUM System User s Guide. Use the graph properties button to modify the presentation of the graph. It has three options: Scroll to Date-Time sets the viewing area to begin at a specified date and time. Accessing Token Ring Views Change Time Scale sets the Y axis time scale for the graph. Data Logging data logging is not relevant for the Segment Performance Views of the RMON Probe models. Use the Lin/Log toggle button to toggle between a linear and a logarithmic scale presentation of the graph. Viewing Statistics with the Details Button Click the Details button in the Performance View for more diagnostic detail. The Statistics Detail View appears; it presents a graphical breakdown of the isolating errors, non-isolating errors, and events. These statistics are updated and presented as totals or deltas. Each pie chart provides a color-coded view of events on the interface. Click on the Total, Delta, or Accum buttons to modify the data output. Total The parameter s value over this instance s entire interval. Delta The parameter s value over the duration of the update interval. Accum The parameter s value over the interval since the Accum button was selected. Device Management Page 85 RMON/RMON2

86 Using RMON Accessing Token Ring Views Promiscuous Statistics Access: From the Icon Subviews menu for an RMONethProbe, select Promiscuous Statistics. The Promiscuous Statistics Table (Figure 20) presents the RMON statistics in tabular form. Device Management Page 86 RMON/RMON2

87 Using RMON Accessing Token Ring Views Figure 20: Promiscuous Statistics Table Device Management Page 87 RMON/RMON2

88 Using RMON The RMON Statistics group consists of the following 7 parameters measured at the monitored network interface (data source) of the device. These statistics take the form of free running counters that start from zero when a valid instance is created. Data Source The interface being monitored. Octets Total octets of data in packets collected promiscuously (excluding those that were not good frames) on the network. Packets Total packets collected promiscuously (excluding packets that were not good frames). Broadcast Total broadcast packets collected promiscuously by the probe. Multicast Total multicast packets collected promiscuously by the probe. Owner The entity that configured this entry. Drop Events Total drop events detected by the probe. Viewing Performance Statistics on the Segment Double click on any instance (row or interface) in the Promiscuous Statistics Table to view the Accessing Token Ring Views RMON data presented in SPECTRUM Performance View format. This allows you to view current percentage calculations and a time graph of the interface activity, rather than the absolute numbers of the Statistics Table. Note that this view is dynamically updated. Viewing Network Activity With the Multi-Attribute Line Graph The Multi-Attribute Line Graph provides a general indication of network activity. The attributes colors represent different statistics. Green represents Load, blue the Frame Rate, orange the Broadcast and yellow the Multicast. You can scroll back in time to view previously logged values for these attributes. For more information, refer to the SPECTRUM System User s Guide. Use the Lin/Log toggle button to toggle between a linear and a logarithmic scale presentation of the graph. Use the graph properties button to modify the presentation of the graph. It has three options: Scroll to Date-Time sets the viewing area to begin at a specified and time. Change Time Scale sets the Y axis time scale for the graph. Device Management Page 88 RMON/RMON2

89 Using RMON Data Logging data logging is not relevant for the Segment Performance Views of the RMON Probe models. Viewing Statistics with the Frame Details Button Click the Frame Details button in the Performance View for more diagnostic detail. This displays the Statistics Detail View which presents a graphical breakdown of the frame size distribution. These statistics are updated and presented as totals or deltas. Click on the Total, Delta, or Accum buttons to modify the data output. Accessing Token Ring Views > Mac-Layer History From the Icon Subviews menu, click on Mac- Layer History. The Mac-Layer History Table presents the RMON Mac-layer data in tabular form. The RMON History group records data from the Statistics group over user-defined intervals and stores it for later retrieval, allowing you to perform trend analysis of a statistic over time or to isolate periods of time during which a network event may have occurred. Total The parameter s value over this instance s entire interval. Delta The parameter s value over the duration of the update interval. Accum The parameter s value over the interval since the Accum button was selected. The Frame Breakdown pie chart provides a color coded view of the network segments total traffic by frame size, separated into the following categories: Device Management Page 89 RMON/RMON2

90 Using RMON Accessing Token Ring Views Figure 21: Mac-Layer History Control Table View Device Management Page 90 RMON/RMON2

91 Using RMON The History Control Table (Figure 21) presents the configuration of each History instance running on the network interface. By default, the RMON standard specifies 2 instances, having intervals of 1800 seconds and 30 seconds. Each instance features the following fields: Data Source Interface being monitored. Interval The sample collection interval. SizeReq Maximum number of recorded intervals (buckets) requested for the sample Size The number of buckets correctly recorded in the sample. Accessing Token Ring Views detailed descriptions of the fields found in the History Table. Promiscuous History From the Icon Subviews menu, click on Promiscuous History. The Promiscuous History Table presents the RMON Promiscuous data in tabular form. The RMON History group records data from the Statistics group over user-defined intervals and stores it for later retrieval, allowing you to perform trend analysis of a statistic over time or to isolate periods of time during which a network event may have occurred. Owner The person who configured the entry. Status The status of the control table entry. Note that when the values for SizeReq and Size are identical, the oldest entries in the History Control Table for that instance will be replaced by the newest entries. Viewing the History Table Double click any Mac-Layer History Control Table entry to display the data for that instance. The History Table shows the past performance measured at the monitored network interface (data source) of the device. Appendix B contains Device Management Page 91 RMON/RMON2

92 Using RMON Accessing Token Ring Views Figure 22: Promiscuous History Control Table View Device Management Page 92 RMON/RMON2

93 Using RMON The History Control Table (Figure 22) presents the configuration of each History instance running on the network interface. By default, the RMON standard specifies 2 instances, having intervals of 1800 seconds and 30 seconds. Each instance features the following fields: Data Source Interface being monitored. Interval The sample collection interval. SizeReq Maximum number of recorded intervals (buckets) requested for the sample Size The number of buckets correctly recorded in the sample. Owner The person who configured the entry. Status The status of the control table entry. Note that when the values for SizeReq and Size are identical, the oldest entries in the History Control Table for that instance will be replaced by the newest entries. Accessing Token Ring Views detailed descriptions of the fields found in the History Table. Ring Station From the Icon Subviews Menu, click on Ring Station. The menu selection is available only from the RMONTRProbe model. When you click on the Ring Station selection, the Ring Station Control View (Figure 23) appears. This Token Ring View includes the Ring Station and Ring Station Order Groups. The Ring Station group provides status information for the ring being monitored. In addition, it provides statistics and status information associated with each Token Ring station on the ring. The Ring Station Order group provides the order of the stations on the monitored ring. Viewing the History Table Double click any Promiscuous History Control Table entry to display the data for that instance. The History Table shows the past performance measured at the monitored network interface (data source) of the device. Appendix B contains Device Management Page 93 RMON/RMON2

94 Using RMON Accessing Token Ring Views Figure 23: Ring Station Control View Station Order button Non-Isolating Errors button Isolating Errors button Device Management Page 94 RMON/RMON2

95 Using RMON Accessing Token Ring Views Appendix B contains detailed descriptions of the fields found in the Ring Station Control View. Viewing the Station Order Click on the Station Order button to view the Station Order Table which shows a screen similar to the following. Device Management Page 95 RMON/RMON2

96 Using RMON Accessing Token Ring Views Figure 24: Station Order Device Management Page 96 RMON/RMON2