RFC 3577 (rfc3577) - Page 3 of 31
Introduction to the Remote Monitoring (RMON) Family of MIB Modules
Alternative Format: Original Text Document
RFC 3577 Introduction to RMON August 2003
When the work on the RMON documents was started, this device-oriented
definition of RMON was taken quite literally, as RMON devices were
purpose-built probes and dedicated to implementing the RMON MIB
modules. Soon, cards were introduced that added RMON capability into
a network hub, switch or router. RMON also began to appear as a
software capability that was added to the software of certain network
equipment, as well as software applications that could run on servers
or clients. Despite the variety of these approaches, the RMON
capability in each serves as a dedicated network management resource
available for activities ranging from long-term data collection and
analysis or for ad-hoc firefighting.
In the beginning, most, but not all, of RMON's capabilities were
based on the promiscuous capture of packets on a network segment or
segments. Over time, that mixture included more and more
capabilities that did not depend on promiscuous packet capture.
Today, some of the newest documents added to the RMON framework allow
multiple techniques of data gathering, where promiscuous packet
capture is just one of several implementation options.
3. Goals of RMON
o Offline Operation
There are sometimes conditions when a management station will
not be in constant contact with its remote monitoring devices.
This is sometimes by design in an attempt to lower
communications costs (especially when communicating over a WAN
or dialup link), or by accident as network failures affect the
communications between the management station and the probe.
For this reason, RMON allows a probe to be configured to
perform diagnostics and to collect statistics continuously,
even when communication with the management station may not be
possible or efficient. The probe may then attempt to notify
the management station when an exceptional condition occurs.
Thus, even in circumstances where communication between
management station and probe is not continuous, fault,
performance, and configuration information may be continuously
accumulated and communicated to the management station
conveniently and efficiently.
o Proactive Monitoring
Given the resources available on the monitor, it is potentially
helpful for it to continuously run diagnostics and to log
network performance. The monitor is always available at the
onset of any failure. It can notify the management station of
Waldbusser, et al. Informational