RMON and RMON Probes


RMONand RMON Probes

RemoteMonitoring (RMON)

Abbreviatedas RMON, Remote Monitoring is an IT system that enables a networkadministrator to remotely manage or monitor the traffic in aparticular virtual local area network or a LAN. An RMON was developedby the InternetEngineering Task Force(IETF)to support the monitoring LAN through protocol analysis. In moresimplistic terms, an RMON is a Simple Network Management Protocol(SNMP) extension that allows the process of comprehensive monitoringstatistics of an Ethernet network (Pathan et al, 2013). The maindefining function of RMON is that it allows monitoring of a networkfrom a central location in a network, but on a remote Ethernetsegment (Karris, 2009). This makes it possible to detect problems inthe network such as dropped packets, congestion or even excessivecollisions.

RMONcan also be applied in the setting of thresholds for traffic thatcreates a trigger for alarms or notifications that there is a problemin the network that require rectification. The alarm or thenotification is activated once a certain type of problem is detectedor a certain amount of problems is detected on a network (Karris,2009). The use of embedded RMON is also applied by networkadministrators to allow them to monitor Ethernet networks that areswitched and cannot be accessed for monitoring. This is easily doneby network administrators through the use of traditional networkanalyzers for packet sniffing.


AnRMON probe is an investigation into a network through the use of theremote network monitoring system. This involves the application of anSTP agent to collect data and communicate with an STP managementapplication to pass the collected information for analysis (Pathan etal, 2013). The process can involve the use of more than one RMON tomonitor a network. To facilitate the functionality of an RMON, anSNMP-manageable device like a router or a hub can be installed on anetwork to provide additional software. This increased functionalityfrom the SNMP-manageable device turns an RMON into a probe (Pathan etal, 2013). Additional devices commonly referred to as hosted probescan be implemented in the form of add-on hardware modules that havebuilt-in processing memory.

Utilizationin Enterprise Network Management Systems

Inthe same way that SNMP works, RMON is implemented on RMON-enableddevices as a standard Management Information Base (MIB) (Karris,2009). The RMON-enabled devices that are applied to run the RMON,they include stand-alone devices and existing network devices.Stand-alone devices are RMON probes that are dedicated to monitoringnetworks and can be installed on permanent or temporary basis. Theyare installed on the segments of the network that require suchdedicated probes. Existing network devices like hubs, repeaters,Ethernet switches, bridges or routers are used as probes by embeddingRMON probes into them (Karris, 2009). These two categories ofRMON-enabled devices are the main applications used for remotemonitoring of a network by turning them into probes.

RMONis normally installed on only one interface or device per a subnet ofTCPIP. The RMON software runs on the router at the port or a switch,thereby monitoring or collecting statistics about an Ethernet networkrelating to the attached subnet. The statistics collected by an RMONthrough an RMON probe relates to two main layers of the network.These are the data-link layer and the physical layer. The physicallayer is commonly referred to as layer 1 while the data-link layer isthe layer 2 as they relate to the Open Systems Interconnection (OSI)networking model (Pathan et al, 2013).

AnRMON agent is contacted by an SNMP management console when the SNMPwants to gather statistics needed for the analysis. After analyzingthem, the SNMP console reports the information to a networkadministrator or to a device that is conditioned to trigger anotification to the network manager (Karris, 2009). This notificationhappens through the use of alarm conditioning that is done with SNMPtraps that range of the type of network problem or number of problemsidentified (Pathan et al, 2013). An RMON agent can also collectstatistics and store them so as to monitor the trends in the trafficon the network. This allows it to provide information whenever ananomaly is detected.

Afunctional RMON MIB contains nine RMON monitoring elements that arealso referred to as RMON1 groups of manageable RMON objects. Thesedifferent groups are used for different functions by monitoringEthernet networks. Statistics are a group that records Ethernetnetwork statistics such as packets sent, packets received, and typeof packets transferred, packets dropped, traffic collision, networkerrors and bytes sent and received (Karris, 2009). History groupinvolves the type of data and frequency at which the data is beingsampled for analysis. Alarms are the group that allows setting ofthresholds that trigger notifications of alarms. The fourth group isthe Host which records MAC addresses in terms of the packet receivedand sent and the level of errors detected in the packet transfer(Pathan et al, 2013).

Thefifth group is the HostTopNthatallows an administrator to list the hosts in terms of ranks usingparameters like errors detected or traffic generated. The matrixgroups record statistics for exchange of information between hostssuch as the number of packets transferred and the addresses of thedestinations. The filter group is controlling the type of packetscaptured by the RMON agents through the use of parameters like thesize, combinations or individual data packets (Pathan et al, 2013).The capture is the eighth group that allows the administrator tocapture for configuring buffer sizes and collect statistics of anetwork. The ninth group is the Events group that allows thegeneration of log entries and SNMP traps by the networkadministrators.

Benefitsof to the Company

Oneof the benefits of RMON is that they improve the efficiency of thenetwork management and problem detection. Through the use of RMONlets a network administrator to collect information about thecompany’s LAN or VLANs while he or she is located at oneworkstation. The use of RMON and RMON probes will allow the companyto avoid the need for different administrators or movements ofadministrators without necessity (Pathan et al, 2013). This promotesefficiency in the management of a network and reduces the time takenby an administrator to locate and eliminate a problem this is becausethe use of RMON probes eliminates the need for setting, freshequipment and devices since an administrator use one working stationto manage and monitor the entire network.

RMONand RMON probes enables a company to manage the network in aproactive manner rather than a reactive manner. With well configuredRMON devices, RMON probes gather and reports information on errors orproblems before they physically manifest or occur in the network(Pathan et al, 2013). This allows the network managers to detect andcorrect problems and network issues before they affect the users ofthe network of the company. Moreover, the use of RMON probes allows anetwork administrator to understand the behavior of a network byanalyzing its trends. This helps him or her to probe the possiblecauses of problems or potential causes of network issues.

Theuse of RMON and RMON probes reduces the load on the management of anetwork and the workstation by carrying the monitoring and providingreports or notifications. This relieves the network managementworkstation from the task of regular monitoring. The conventionalmanagement of a network involves the administration workstation topoll network devices regularly with pre-set intervals in order tocollect information about the network. This burdens the managementworkstation especially when the network sizes become bigger and thelevels of traffic increase (Pathan et al, 2013). This lead to astrain on the workstation that manages the network as it generates alot of traffic and burdens it processors. Unlike this traditionalway, an RMON probe works anonymously and reports to the administratorby exception when there is an abnormality. Therefore, RMON monitorsthe network without affecting the performance of the network.


RMONand RMON probes allow network administrators of a company to monitorthe details and statistics of networks to detect any anomalies. RMONand RMON probes allow network administrators to manage networksefficiently and anonymously, thereby relieving the managementworkstation. In addition, RMON probes allow proactive management of acompany network by detecting problems before they affect the user inthe company. This makes RMON and RMON probes very important in themanagement of a network for the company. Therefore, it is highlyrecommended that the company implements the use of RMON and RMONprobes in the network management.


Karris,S. (2009). Networks:Design and Management.Fremont, CA: Orchard Publications

Pathan,A. S. et al. (2013). BuildingNext-Generation Converged Networks: Theory and Practice.New York: CRC Press