Lecture 15: Remote Monitoring (RMON)

Transcription

1 Lecture 15: Remote Monitoring (RMON) Prof. Shervin Shirmohammadi SITE, University of Ottawa Prof. Shervin Shirmohammadi CEG RMON Remote Network Monitoring (RMON): monitoring the state of a network and its nodes through a remote probe. Why? Significantly reduces SNMP traffic due to local polling. No need for agent to be visible to managers all the time. Reduces Ping messages. Continuous monitoring of individual segments Has been shown to increase productivity for network administrators. components: Data gatherer: a physical device Data analyzer: processor that analyzes RMON does both and reports to a manager. Prof. Shervin Shirmohammadi CEG

2 RMON in the Network All 4 probes in this example are RMON probes. Remote FDDI LAN Router with RMON FDDI Probe Router FDDI Backbone Network Bridge Local LAN Router Remote Token Ring LAN NMS Ethernet Probe Token Ring Probe Figure 8.1 Network Configuration with RMONs Prof. Shervin Shirmohammadi CEG RMON MIB Ethernet RMON: (rmon 1-9) Token ring extension: (rmon 10) RMON 2: Higher layers (rmon 3 7 and rmon 11-20) rmon (mib-2 16) statistics (1) history (2) alarm (3) host (4) hosttopn (5) (6) filter (7) capture (8) event (9) rmonconformance (20) probeconfig (19) usrhistory (18) a1matrix (17) a1host (16) n1matrix (15) n1host (14) addressmap (13) protocoldist (12) protocoldir (11) Token Ring (10) RMON1 RMON1 Extension RMON2 Figure 8.2 RMON Group Prof. Shervin Shirmohammadi CEG

3 Row Creation & Deletion EntryStatus type introduced in RMON similar to RowStatus in SNMPv2 used to create and delete conceptual row. Only 4 states in RMON compared to 6 in SNMPv2 State Enumeration Description valid 1 Row exists and is active. It is fully configured and operational createrequest 2 Create a new row by creating this object undercreation 3 Row is not fully active invalid 4 Delete the row by disassociating the mapping of this entry Prof. Shervin Shirmohammadi CEG RMON Groups and Functions Probe gathers Functions Statistics on Ethernet, token ring, and hosts conversations Filter group filters Remotely Monitored Network prior to capture of Generation of alarms and events Data Gathering Token Ring Statistics Token Ring Statistics Ethernet Statistics Ethernet Statistics Host and Conversation Statistics Host Statistics Filter Group Packet Filtering Alarm Generation Token Ring History Ethernet History HostTopN Statistics Channel Filtering Event Generation History History Matrix Statistics Packet Capture Network Manager Figure 8.3 RMON1 Groups and Functions Prof. Shervin Shirmohammadi CEG

4 RMON1 MIB Groups & Tables Ten groups divided into three categories Statistics groups (rmon 1, 2, 4, 5, 6, and 10) Event reporting groups (rmon 3 and 9) Filter and packet capture groups(romon 7 and 8) Groups with 2 in the name are enhancements with RMON2 Group OID Function Tables Statistics rmon 1 Link level statistics -etherstatstable -etherstats2table History rmon 2 Periodic statistical collection and storage for later retrieval Alarm rmon 3 Generates events when the sample gathered crosses preestablished thresholds -historytable -etherhistorytable -history2table -etherhistory2table -alarmtable Host rmon 4 Gathers statistical on hosts -hosttable -hosttable -hosttimetable -host2table HostTopN rmon 5 Computes the top N hosts on the respective categories of statistics gathered Matrix rmon 6 Statistics on traffic between pair of hosts Filter rmon 7 Filter function that enables capture of desired parameters Packet Capture rmon 8 Packet capture capability to gather packets after they flow through a -hosttopntable -Table -Table -DSTable -2Table -filtertable -Table -filter2table -2Table -buffertable -capturebuffertable Event rmon 9 s the generation of -eventtable events and notifications Token Ring rmon 10 See Table 8.3 See Table 8.3 Prof. Shervin Shirmohammadi CEG and Data Tables table used to set the instances of rows in the table. Can be set to gather and store different instances of. Values of index and index are the same. Table Table Entry Entry Addl DataSource TableSize Owner Status Addl DataSource TableSize Owner Status Addl Addl Note on Indices: Indices marked in bold letter Value of same as value of Prof. Shervin Shirmohammadi CEG Figure 8.4 Relationship between and Data Tables 4

5 Table Values Integer uniquely identifying the row in the table. DataSource identifies the source of the being collected. TableSize identifies the entries associated with the source. Owner entity or person that created the entry. Can be a management station name, phone number, contact info Status entry status of textual conversion (valid, createrequest, undercreation, invalid). Could be another object Prof. Shervin Shirmohammadi CEG Example: Matrix and Tables Table Table Entry Entry Source Destination = 1 Pkts = = 1 DataSource =ifindiex.1 TableSize = 10 Owner = "Bob" Status = 1 Last DeleteTime = 1000 Source Destination = 1 Pkts = = 2 DataSource =ifindiex.2 TableSize = 10 Owner = "Bob" Status = 1 Note on Indices: Indices marked in bold letter Value of same as value of Last DeleteTime = Source Source Destination Destination = 2 = 2 Pkts = Pkts = Prof. Shervin Shirmohammadi CEG Figure 8.4 Relationship between and Data Tables 5

6 The Statistics Group The simplest of the RMON groups. Counters to store number of packets. The etherstatstable in this group has an entry for each interface. Counts packets with characteristics defined by objects in the etherstatstable. There are 21 columns in the table, such as: etherstatsoversizepackets - >1518 octets etherstatsundersizepackets - < 64 octets etherstatscrcalignerrors etherstatscollision etherstatspkts65to127octests etherstatspkts128to255octests etherstatspkts256to511octests Good example of monitoring! Prof. Shervin Shirmohammadi CEG History Group Enables the network manager to build a record of what is happening in the network over time. Two tables: historytable (7 columns) allows for the settings: Data source historydatasource sampling intervals historyinterval Number of sampling intervals historycontolbuckets etherhistorytable (15 columns) allows for Ethernetspecific settings how many Ethernet packets were sampled in the interval time. Prof. Shervin Shirmohammadi CEG

7 Host Group Identifies traffic statistics with the host that is detected on the subnet. This group makes a connection between the host and the traffic. We can ask a question like Why is host A transmitting more packets than host B? Three tables: hosttable (6 columns), records the number of hosts that have transmitted or received frames in the subnet. hosttable (10 columns), the actual For each interface specified in hosttable, hosttable contains one row for each MAC address on that interface. instance identifier for the hostaddress object: = MAC address Object 6 = Number of Octets in the Ethernet address = decimal equivalent to A3 E hosttimetable (10 columns) information stored based on time, not MAC Has the exact same information as hosttable, except it is index by creation order, not MAC address Prof. Shervin Shirmohammadi CEG Host Top N Group This group makes it possible to calculate the rate at which host traffic for one of the variables listed in the hosttable is increasing or decreasing (Rate of change). Because views of hosttopn objects are time-dependant views may not correspond to one another in time. In addition to its table it has the hosttopntable that keeps: hosttopn identifies the from one host hosttopnaddress MAC Address hosttopnrate amount of change packets/s Host 1 Host 2 Host 3 Host 4 Host 5 Host 6 Host 7 Host 8 Host 9 Host 10 HostTopN Giga Octets Figure 8.5 HostTop-10 Output Octets Prof. Shervin Shirmohammadi CEG

8 Matrix Group This allows us to determine the source and destination of a communication. Aadds another dimension to network management in that we will know which communications are causing the most traffic, not just which hosts. This is done using 3 tables: Table Table ed by matric, then by source address, then by destination address matricdstable ed by matricds, then by destination address, then by source address Prof. Shervin Shirmohammadi CEG Table Example Source Address Dest Address Pkts Octets Errors A B A C A D B C B D C D Prof. Shervin Shirmohammadi CEG

9 Filter and Capture Group Capture group used to capture packets from a probe to a management station. Filter group defines how to filter that using logical expressions. These 2 groups are closely related. For each capture buffer created in a probe there is a corresponding row in the buffertable. These are known as s. Channel is a stream of captured based on a logical expression. Each row in the capturebuffertable corresponds to each packet in the a buffer. A row in the table is associated with multiple rows in the filter table. i.e a set of filters can be associated with a. If a packet passes each test then it is associated with that Prof. Shervin Shirmohammadi CEG Filter table allows packets to be filtered with an arbitrary filter expression Defines the filtertable and Table The filters at this level are based on matching bits to a mask. This leads to fairly complicated procedure that needs to be followed to set up a and filter. =1 = 2 Filter Group If = 1 If Table Entry AcceptType AcceptType Data Data Note on Indices: Indices marked in bold letter Value of filterchannel same as value of Channel Channel Somewhat easier to do with a GUI filter = 1 filter = 2 filter = 3 filter = 4 filtertable filterentry filter Channel = 1 filter Channel = 1 filter Channel = 2 filter Channel = 2 Prof. Shervin Shirmohammadi CEG Filter Filter Filter Filter 9

10 Packet Capture Group Packet capture group is a post-filter group Buffer table used to select s Captured stored in the capture buffer table Channel Table Filter Table (many for each ) Capture Buffer Table (One entry per Channel) Prof. Shervin Shirmohammadi CEG Alarm and Event Groups This group of objects consists of one table, the alarmtable (12 columns), that triggers an alarm or event when a particular threshold is reached in the value of the monitored object. Example: an alarm could be generated if there are more than 500 CRC errors in any 5-miute interval. Contains objects such as alarminterval, alarmrisingthreshold, alarmfallingthreshold, Each row in the alarmtable is identified by a threshold value and an object that is sampled for a specified interval. The Alarm Group is closely related to the Event Group that is used to define events that can be triggered by objects in the Alarm Group or elsewhere in the MIB and can trigger actions elsewhere in the MIB. E.g., an alarm triggers an event which then turns the off. Event group consists of two tables: eventtable, which contains event definitions, and LogTable which is a log of events that must be recorded. Prof. Shervin Shirmohammadi CEG

11 Token Ring Extensions Two statistics groups and associated history groups Statistics group collects TR MAC parameters Promiscuous Statistics group collects packets promiscuously on sizes and types of packets Both of the above have associated hsitory groups Three groups associated with the stations: RingStation, RingStationOrder, and RingStationConfiguration. Finally, Routing group gathers on routing. Prof. Shervin Shirmohammadi CEG RMON TR Extension Groups T o k e n R i n g G r o u p F u n c t i o n T a b l e s S t a t i s ti c s C u r r e n t u til i z a tio n a n d e r r o r s ta tis ti c s o f M a c L a y e r t o k e n R in g M L S t a t s T a b le t o k e n R in g M L S t a t s 2 T a b le P r o m i s c u o u s S t a t is ti c s M a c - L a y e r H i s to r y P r o m i s c u o u s H i s t o r y C u r r e n t u til i z a tio n a n d e r r o r s ta tis ti c s o f p r o m is c u o u s d a ta H i s to ric a l u t ili z a tio n a n d e r r o r s t a ti s ti c s o f M a c L a y e r H i s to ric a l u t ili z a tio n a n d e r r o r s t a ti s ti c s o f p r o m i s c u o u s d a t a t o k e n R in g P S ta ts T a b le t o k e n R in g P S ta ts 2 T a b l e t o k e n R in g M L H i s to r y T a b l e t o k e n R in g P H i s to r y T a b l e R in g S ta ti o n S ta ti o n s t a ti s ti c s r i n g S t a ti o n C o n tr o l T a b l e r i n g S t a ti o n T a b l e r i n g S t a ti o n C o n tr o l 2 T a b le R in g S ta ti o n O r d e r R in g S ta ti o n C o n f i g u r a tio n S o u r c e R o u ti n g O r d e r o f t h e s ta t io n s A c ti v e c o n fig u r a tio n o f r i n g s ta ti o n s U t ili z a ti o n s t a ti s ti c s o f s o u r c e r o u ti n g i n f o r m a t io n r i n g S t a ti o n O r d e rt a b le r i n g S t a ti o n C o n fi g C o n t r o lt a b l e r i n g S t a ti o n C o n fi g T a b le s o u r c e R o u ti n g S t a t s T a b le s o u r c e R o u ti n g S t a t s 2 T a b l e Prof. Shervin Shirmohammadi CEG