New Job RMON Research Nearly every business depends on smooth-running communications networks. So the need for professionals that know how to design, implement, secure, and manage them is everywhere. After doing Network and Communications Management Degree Program. With new positions opening up and older NCM workers retiring, networking promises to be a growing career field in North America for years to come. After reading this report we will get that the features of it and how it will benefits to our organization to fulfill the corporate network solutions. Now I am going to tell you what are RMON and RMON probes and how they are utilized in enterprise network management systems and how they would benefit the company: RMON (Remote Network Monitoring) provides standard information that a network administrator can use to monitor, analyze, and troubleshoot a group of distributed local area networks (LANs) and interconnecting T-1/E-1 and T-2/E-3 lines from a central site. It's specified as part of the Management Information Base (MIB) in Request for Comments 1757 as an extension of the Simple Network Management Protocol (SNMP). RMON can be supported by hardware monitoring devices (known as "probes") or through software or some combination. For example, Cisco's line of LAN switches includes software in each switch that can trap information as traffic flows through and record it in its MIB. RMON collects nine types of information, including packets sent, bytes sent, packets dropped, statistics by host, by conversations between two sets of addresses, and certain kinds of events that have occurred. A network administrator can find out how much bandwidth or traffic each user is imposing on the network and what Web sites are being accessed. Alarms can be set in order to be aware of impending problems. Software, on managed devices, that collects and stores management information, including SNMP agents and RMON agents. RMON is an extension of the MIB. The MIB typically provides only static information about the managed device; the RMON agent collects specific groups of statistics for long-term trend analysis. RMON agents can reside in routers, switches, hubs, servers, hosts, or dedicated RMON probes. Because RMON can collect a lot of data, dedicated RMON probes are often used on routers and switches instead of enabling RMON agents on these devices. Performance thresholds can be set and reported on if the threshold is breached; this helps reduce management traffic. RMON provides effective network fault diagnosis, performance tuning, and planning for network upgrades. RMON1 works on the data link layer (with MAC addresses) and provides aggregate LAN traffic statistics and analysis for remote LAN segments. Because RMON agents must look at every frame on the network, they might cause performance problems on a managed device. The agent's performance can be classified based on processing power and memory. The RMON MIB is 1.3.6.1.2.1.16. RMON agents gather nine groups of statistics, ten including Token Ring, which are forwarded to a manager on request, usually via SNMP. As summarized in Figure, RMON1 agents can implement some or all of the following groups: Statistics: Contains statistics such as packets sent, bytes sent, broadcast packets, multicast packets, CRC errors, runts, giants, fragments, jabbers, collisions, and so forth, for each monitored interface on the device. History: Used to store periodic statistical samples for later retrieval. Alarm: Used to set specific thresholds for managed objects and to trigger an event on crossing the threshold (this requires an Events group). Host: Contains statistics associated with each host discovered on the network. Host Top N: Contains statistics for hosts that top a list ordered by one of their observed variables. Matrix: Contains statistics for conversations between sets of two addresses, including the number of packets or bytes exchanged between two hosts. Filters: Contains rules for data packet filters; data packets matched by these rules generate events or are stored locally in a Packet Capture group. Packet Capture: Contains data packets that match rules set in the Filters group. Events: Controls the generation and notification of events from this device. Token Ring: Contains the following Token Ring Extensions: Ring Station: Detailed statistics on individual stations. Ring Station Order: Ordered list of stations currently on the ring. Ring Station Configuration: Configuration information and insertion/removal data on each station. Source Routing: Statistics on source routing, such as hop counts RMON1 only provides visibility into the data link and the physical layers; potential problems that occur at the higher layers still require other capture and decode tools. Because of RMON1's limitations, RMON2 was developed to extend functionality to upper-layer protocols. RMON2 provides full network visibility from the network layer through to the application layer. RMON2 is not a replacement for RMON1, but an extension of it. RMON2 extends RMON1 by adding nine more groups that provide visibility to the upper layers. With visibility into the upper-layer protocols, the network manager can monitor any upper-layer protocol traffic for any device or subnet in addition to the MAC layer traffic. RMON2 allows the collection of statistics beyond a specific segment's MAC layer and provides an end-to-end view of network conversations per protocol. The network manager can view conversations at the network and application layers. Therefore, traffic generated by a specific host or even a specific application (for example, a Telnet client or a web browser) on that host can be observed. RMON groups that were added when RMON2 was introduced. They include the following: Protocol Directory: Provides the list of protocols that the device supports. Protocol Distribution: Contains traffic statistics for each supported protocol. Address Mapping: Contains network layer-to-MAC layer address mappings. Network Layer Host: Contains statistics for the network layer traffic to or from each host. Network Layer Matrix: Contains network layer traffic statistics for conversations between pairs of hosts. Application Layer Host: Contains statistics for the application layer traffic to or from each host. Application Layer Matrix: Contains application layer traffic statistics for conversations between pairs of hosts. User History Collection: Contains periodic samples of user-specified variables. Probe Configuration: Provides a standard way of remotely configuring probe parameters, such as trap destination and out-of-band management. In short, RMON is designed for "flow-based" monitoring, while SNMP is often used for "device-based" management. RMON is similar to other flow-based monitoring technologies such as NetFlow and SFlow because the data collected deals mainly with traffic patterns rather than the status of individual devices. RMON enhances the management and control capabilities of Simple Network Management Protocol-compliant network management systems and LAN analyzers. Remote Monitoring equipped probes can view every packet and produce summary information on various types of packets, such as undersized packets, and events, such as packet collisions. The probes may also store information for further analysis by capturing packets according to predefined criteria set by the network manager or test technician. RMON is typically offered as an optional expansion package to vendors' Simple Network Management Protocol-compliant network management systems, facilitating the gathering of information from network devices, which can be used for fault diagnosis, performance tuning, and network planning One disadvantage of this system is that remote devices shoulder more of the management burden, and require more resources to do so. Some devices balance this trade-off by implementing only a subset of the RMON MIB groups (see below). A minimal RMON agent implementation could support only statistics, history, alarm, and event.