Ethernet Object Groups in Visual C#

Decoder PDF 417 in Visual C# Ethernet Object Groups

9

perform baseline measurements and long-term reporting Alarms can be set on any RMON variable, and notification via traps can be sent to multiple management stations Baseline statistics enable long-term trend analysis of network traffic patterns that can be used to plan for network growth

The original RMON specification consists of nine Ethernet groups, which are discussed later The drawback to this implementation of RMON is that it is capable of collecting information up to the MAC layer only A follow-up specification called RMON-II enables probes to gather information from the network layer (Layer 3) all the way up to the application layer (Layer 7) of the Open Systems Interconnection (OSI) reference model The ramifications of this are that RMON-II probes can gather not only the information its predecessor can, but also information about network-specific applications like the Hypertext Transfer Protocol (HTTP), Network File System (NFS), AppleTalk, and Internetwork Packet Exchange (IPX) With this added data collection capability, administrators can obtain a more complete picture of the enterprise network Ethernet Statistics Group The Statistics Group provides segment-level statistics (see Figure 9-3) These statistics show packets, octets (or bytes), broadcasts, multicasts, and collisions on the local segment, as well as the number of occurrences of dropped packets by the agent Each statistic is maintained in its own 32-bit cumulative counter Real-time packet size distribution is also provided Ethernet History Group With the exception of packet-size distribution, which is provided only on a real-time basis, the History Group provides historical views of the statistics provided in the Statistics Group The History Group can respond to user-defined sampling intervals and bucket counters, allowing for some customization in trend analysis The RMON MIB comes with two defaults for trend analysis The first provides for 50 buckets (or samples) of 30-second sampling intervals over a period of 25 minutes The second provides for 50 buckets of 30-minute sampling intervals over a period of 25 hours Users can modify either of these or add additional intervals to meet specific requirements for historical analysis The sampling interval can range from one second to one hour

Figure 9-3 The Ethernet Statistics window accessed from Enterasys Networks NetSight Element Manager This window can be used to view a detailed statistical breakdown of traffic on the monitored Ethernet network segment The data provided applies only to the interface or network segment, either wired or wireless

Host Table Group The RMON MIB specifies a host table that includes node traffic statistics: packets sent and received, octets sent and received, and broadcasts, multicasts, and errored packets sent In the host table, the classification errors sent is the combination of undersized packets, fragments, Cyclic Redundancy Check (CRC)/alignment errors, collisions, and oversized packets sent by each node The RMON MIB also includes a host timetable that shows the relative order in which the agent discovered each host This feature is not only useful for network management purposes, but it also assists in uploading those nodes to the management station of which it is not yet aware This reduces unnecessary SNMP traffic on the network Host Top N Group The Host Top N Group extends the host table by providing sorted host statistics, such as the top 10 nodes sending packets or an ordered list of all nodes according to the errors sent over the last 24 hours The data selected and the duration of the study are both defined at the network management station The number of studies that can be run depends on the resources of the monitoring device

9

When a set of statistics is selected for study, only the selected statistics are maintained in the Host Top N counters; other statistics over the same time intervals are not available for later study This processing, performed remotely in the RMON MIB agent, reduces SNMP traffic on the network and the processing load on the management station, which would otherwise need to use SNMP to retrieve the entire host table for local processing Alarms Group The Alarms Group provides a general mechanism for setting thresholds and sampling intervals to generate events on any counter or integer maintained by the agent, such as segment statistics, node traffic statistics defined in the host table, or any user-defined packet match counter defined in the Filters Group Both rising and falling thresholds can be set, each of which can indicate network faults Thresholds can be established for both the absolute value of a statistic or its delta value, enabling the manager to be notified of rapid spikes or drops in a monitored value Filters Group The Filters Group provides a generic filtering engine that implements all packet capture functions and events The packet capture buffer is filled with only those packets that match the user-specified filtering criteria Filtering conditions can be combined using the Boolean parameters and or not Multiple filters are combined with the Boolean or parameter Packet Capture Group The type of packets collected is dependent upon the Filter Group The Packet Capture Group enables the user to create multiple capture buffers and to control whether the trace buffers will wrap (overwrite) when full or stop capturing The user may expand or contract the size of the buffer to fit immediate needs for packet capturing, rather than permanently committing memory that will not always be needed Notifications (Events) Group In a distributed management environment, the RMON MIB agent can deliver traps to multiple management stations that share a single community name destination specified for the trap In addition to the three traps already mentioned rising threshold, falling threshold (refer to Alarms Group ), and packet match (refer to Packet Capture Group ) seven additional traps can be specified:

coldStart This trap indicates that the sending protocol entity is reinitializing itself such that the agent s configuration or the protocol entity implementation may be altered warmStart This trap indicates that the sending protocol entity is reinitializing itself such that neither the agent configuration nor the protocol entity implementation is altered