RFC 3577 (rfc3577) - Page 3 of 31

Introduction to the Remote Monitoring (RMON) Family of MIB Modules

RFC 3577                  Introduction to RMON               August 2003


   When the work on the RMON documents was started, this device-oriented
   definition of RMON was taken quite literally, as RMON devices were
   purpose-built probes and dedicated to implementing the RMON MIB
   modules.  Soon, cards were introduced that added RMON capability into
   a network hub, switch or router.  RMON also began to appear as a
   software capability that was added to the software of certain network
   equipment, as well as software applications that could run on servers
   or clients.  Despite the variety of these approaches, the RMON
   capability in each serves as a dedicated network management resource
   available for activities ranging from long-term data collection and
   analysis or for ad-hoc firefighting.

   In the beginning, most, but not all, of RMON's capabilities were
   based on the promiscuous capture of packets on a network segment or
   segments.  Over time, that mixture included more and more
   capabilities that did not depend on promiscuous packet capture.
   Today, some of the newest documents added to the RMON framework allow
   multiple techniques of data gathering, where promiscuous packet
   capture is just one of several implementation options.

3.  Goals of RMON

      o  Offline Operation

         There are sometimes conditions when a management station will
         not be in constant contact with its remote monitoring devices.
         This is sometimes by design in an attempt to lower
         communications costs (especially when communicating over a WAN
         or dialup link), or by accident as network failures affect the
         communications between the management station and the probe.

         For this reason, RMON allows a probe to be configured to
         perform diagnostics and to collect statistics continuously,
         even when communication with the management station may not be
         possible or efficient.  The probe may then attempt to notify
         the management station when an exceptional condition occurs.
         Thus, even in circumstances where communication between
         management station and probe is not continuous, fault,
         performance, and configuration information may be continuously
         accumulated and communicated to the management station
         conveniently and efficiently.

      o  Proactive Monitoring

         Given the resources available on the monitor, it is potentially
         helpful for it to continuously run diagnostics and to log
         network performance.  The monitor is always available at the
         onset of any failure.  It can notify the management station of



Waldbusser, et al.           Informational