Lecture 15: Remote Monitoring (RMON)

Transcription

1 Lecture 15: Remote Monitoring (RMON) Prof. Shervin Shirmohammadi SITE, University of Ottawa Prof. Shervin Shirmohammadi CEG

2 RMON Remote Network Monitoring (RMON): monitoring the state of a network and its nodes through a remote probe. Why? Significantly reduces SNMP traffic due to local polling. No need for agent to be visible to managers all the time. Reduces Ping messages. Continuous monitoring of individual segments Has been shown to increase productivity for network administrators. components: Data gatherer: a physical device Data analyzer: processor that analyzes RMON does both and reports to a manager. Prof. Shervin Shirmohammadi CEG

3 RMON in the Network All 4 probes in this example are RMON probes. Remote FDDI LAN Router with RMON FDDI Probe Router FDDI Backbone Network Bridge Local LAN Router Remote Token Ring LAN NMS Ethernet Probe Token Ring Probe Figure 8.1 Network Configuration with RMONs Prof. Shervin Shirmohammadi CEG

4 RMON MIB Ethernet RMON: (rmon 1-9) Token ring extension: (rmon 10) RMON 2: Higher layers (rmon 3 7 and rmon 11-20) rmon (mib-2 16) statistics (1) history (2) alarm (3) host (4) hosttopn (5) (6) filter (7) capture (8) event (9) rmonconformance (20) probeconfig (19) usrhistory (18) a1matrix (17) a1host (16) n1matrix (15) n1host (14) addressmap (13) protocoldist (12) protocoldir (11) Token Ring (10) RMON1 RMON1 Extension RMON2 Figure 8.2 RMON Group Prof. Shervin Shirmohammadi CEG

5 Row Creation & Deletion EntryStatus type introduced in RMON similar to RowStatus in SNMPv2 used to create and delete conceptual row. Only 4 states in RMON compared to 6 in SNMPv2 State Enumeration Description valid 1 Row exists and is active. It is fully configured and operational createrequest 2 Create a new row by creating this object undercreation 3 Row is not fully active invalid 4 Delete the row by disassociating the mapping of this entry Prof. Shervin Shirmohammadi CEG

6 RMON Groups and Functions Probe gathers Token Ring Statistics Functions Token Ring Statistics Token Ring History History Statistics on Ethernet, token ring, and hosts conversations Filter group filters Remotely Monitored Network Data Gathering Ethernet Statistics Ethernet Statistics Host and Conversation Statistics Host Statistics Ethernet History HostTopN Statistics History Matrix Statistics Network Manager prior to capture of Generation of alarms and events Filter Group Packet Filtering Alarm Generation Channel Filtering Event Generation Packet Capture Figure 8.3 RMON1 Groups and Functions Prof. Shervin Shirmohammadi CEG

7 RMON1 MIB Groups & Tables Ten groups divided into three categories Statistics groups (rmon 1, 2, 4, 5, 6, and 10) Event reporting groups (rmon 3 and 9) Filter and packet capture groups(romon 7 and 8) Groups with 2 in the name are enhancements with RMON2 Group OID Function Tables Statistics rmon 1 Link level statistics -etherstatstable -etherstats2table History rmon 2 Periodic statistical collection and storage for later retrieval Alarm rmon 3 Generates events when the sample gathered crosses preestablished thresholds -historytable -etherhistorytable -history2table -etherhistory2table -alarmtable Host rmon 4 Gathers statistical on hosts -hosttable -hosttable -hosttimetable -host2table HostTopN rmon 5 Computes the top N hosts on the respective categories of statistics gathered Matrix rmon 6 Statistics on traffic between pair of hosts Filter rmon 7 Filter function that enables capture of desired parameters Packet Capture rmon 8 Packet capture capability to gather packets after they flow through a channel -hosttopntable -Table -SDTable -DSTable -2Table -filtertable -channeltable -filter2table -channel2table -buffertable -capturebuffertable Event rmon 9 s the generation of -eventtable events and notifications Token Ring rmon 10 See Table 8.3 See Table 8.3 Prof. Shervin Shirmohammadi CEG

8 and Data Tables table used to set the instances of rows in the table. Can be set to gather and store different instances of. Values of index and index are the same. Table Table Entry Entry Index AddlIndex Other Index DataSource TableSize Owner Status Other Index AddlIndex Other Index DataSource TableSize Owner Status Other Index AddlIndex Other Index AddlIndex Other Note on Indices: Indices marked in bold letter Value of Index same as value of Index Prof. Shervin Shirmohammadi CEG Figure 8.4 Relationship between and Data Tables

9 Table Values Index Integer uniquely identifying the row in the table. DataSource identifies the source of the being collected. TableSize identifies the entries associated with the source. Owner entity or person that created the entry. Can be a management station name, phone number, contact info Status entry status of textual conversion (valid, createrequest, undercreation, invalid). Other Could be another object Prof. Shervin Shirmohammadi CEG

10 Example: Matrix and SD Tables SDTable Table SDEntry Entry SD Source Address = SD Destination Address = SD Index = 1 SD Pkts = Index = 1 DataSource =ifindiex.1 TableSize = 10 Owner = "Bob" Status = 1 Last DeleteTime = 1000 SD Source Address = SD Destination Address = SD Index = 1 SD Pkts = Index = 2 DataSource =ifindiex.2 TableSize = 10 Owner = "Bob" Status = 1 Last DeleteTime = SD Source Address = SD Destination Address = SD Index = 2 SD Pkts = Note on Indices: Indices marked in bold letter Value of Index same as value of Index SD Source Address = SD Destination Address = SD Index = 2 SD Pkts = Prof. Shervin Shirmohammadi CEG Figure 8.4 Relationship between and Data Tables

11 The Statistics Group The simplest of the RMON groups. Counters to store number of packets. The etherstatstable in this group has an entry for each interface. Counts packets with characteristics defined by objects in the etherstatstable. There are 21 columns in the table, such as: etherstatsoversizepackets - >1518 octets etherstatsundersizepackets - < 64 octets etherstatscrcalignerrors etherstatscollision etherstatspkts65to127octests etherstatspkts128to255octests etherstatspkts256to511octests Good example of monitoring! Prof. Shervin Shirmohammadi CEG

12 History Group Enables the network manager to build a record of what is happening in the network over time. Two tables: historytable (7 columns) allows for the settings: Data source historydatasource sampling intervals historyinterval Number of sampling intervals historycontolbuckets etherhistorytable (15 columns) allows for Ethernetspecific settings how many Ethernet packets were sampled in the interval time. Prof. Shervin Shirmohammadi CEG

13 Host Group Identifies traffic statistics with the host that is detected on the subnet. This group makes a connection between the host and the traffic. We can ask a question like Why is host A transmitting more packets than host B? Three tables: hosttable (6 columns), records the number of hosts that have transmitted or received frames in the subnet. hosttable (10 columns), the actual For each interface specified in hosttable, hosttable contains one row for each MAC address on that interface. instance identifier for the hostaddress object: = MAC address Index Object 6 = Number of Octets in the Ethernet address = decimal equivalent to A3 E hosttimetable (10 columns) information stored based on time, not MAC Has the exact same information as hosttable, except it is index by creation order, not MAC address Prof. Shervin Shirmohammadi CEG

14 Host Top N Group This group makes it possible to calculate the rate at which host traffic for one of the variables listed in the hosttable is increasing or decreasing (Rate of change). Because views of hosttopn objects are time-dependant views may not correspond to one another in time. In addition to its table it has the hosttopntable that keeps: hosttopnindex identifies the from one host hosttopnaddress MAC Address hosttopnrate amount of change packets/s Host 1 Host 2 Host 3 Host 4 Host 5 Host 6 Host 7 Host 8 Host 9 Host 10 HostTopN Giga Octets Figure 8.5 HostTop-10 Output Octets Prof. Shervin Shirmohammadi CEG

15 Matrix Group This allows us to determine the source and destination of a communication. Aadds another dimension to network management in that we will know which communications are causing the most traffic, not just which hosts. This is done using 3 tables: Table SDTable Indexed by matricsdindex, then by source address, then by destination address matricdstable Indexed by matricdsindex, then by destination address, then by source address Prof. Shervin Shirmohammadi CEG

16 SDTable Example SD SD SD SD SD SD Source Address Dest Address Index Pkts Octets Errors A B A C A D B C B D C D Prof. Shervin Shirmohammadi CEG

17 Filter and Capture Group Capture group used to capture packets from a probe to a management station. Filter group defines how to filter that using logical expressions. These 2 groups are closely related. For each capture buffer created in a probe there is a corresponding row in the buffertable. These are known as channels. Channel is a stream of captured based on a logical expression. Each row in the capturebuffertable corresponds to each packet in the a buffer. A row in the channel table is associated with multiple rows in the filter table. i.e a set of filters can be associated with a channel. If a packet passes each test then it is associated with that channel Prof. Shervin Shirmohammadi CEG

18 Filter table allows packets to be filtered with an arbitrary filter expression Defines the filtertable and channeltable The filters at this level are based on matching bits to a mask. This leads to fairly complicated procedure that needs to be followed to set up a channel and filter. channel Index =1 channel Index = 2 Filter Group channel IfIndex = 1 channel IfIndex channeltable channelentry channel AcceptType channel AcceptType channel Data channel Data Note on Indices: Indices marked in bold letter Value of filterchannelindex same as value of channelindex Other Channel Parameters Other Channel Parameters Somewhat easier to do with a GUI filterindex = 1 filterindex = 2 filterindex = 3 filterindex = 4 filtertable filterentry filter ChannelIndex = 1 filter ChannelIndex = 1 filter ChannelIndex = 2 filter ChannelIndex = 2 Prof. Shervin Shirmohammadi CEG Filter Parameters Filter Parameters Filter Parameters Filter Parameters

19 Packet Capture Group Packet capture group is a post-filter group Buffer table used to select channels Captured stored in the capture buffer table Channel Table Filter Table (many for each channel) Capture Buffer Table (One entry per Channel) Prof. Shervin Shirmohammadi CEG

20 Alarm and Event Groups This group of objects consists of one table, the alarmtable (12 columns), that triggers an alarm or event when a particular threshold is reached in the value of the monitored object. Example: an alarm could be generated if there are more than 500 CRC errors in any 5-miute interval. Contains objects such as alarminterval, alarmrisingthreshold, alarmfallingthreshold, Each row in the alarmtable is identified by a threshold value and an object that is sampled for a specified interval. The Alarm Group is closely related to the Event Group that is used to define events that can be triggered by objects in the Alarm Group or elsewhere in the MIB and can trigger actions elsewhere in the MIB. E.g., an alarm triggers an event which then turns the channel off. Event group consists of two tables: eventtable, which contains event definitions, and LogTable which is a log of events that must be recorded. Prof. Shervin Shirmohammadi CEG

21 Token Ring Extensions Two statistics groups and associated history groups Statistics group collects TR MAC parameters Promiscuous Statistics group collects packets promiscuously on sizes and types of packets Both of the above have associated hsitory groups Three groups associated with the stations: RingStation, RingStationOrder, and RingStationConfiguration. Finally, Routing group gathers on routing. Prof. Shervin Shirmohammadi CEG

22 RMON TR Extension Groups T o k e n R in g G r o u p F u n c t io n T a b le s S t a tis tic s C u r r e n t u til iz a ti o n a n d e r r o r s ta ti s tic s o f M a c L a y e r t o k e n R in g M L S ta ts T a b le t o k e n R in g M L S ta ts 2 T a b le P r o m is c u o u s S ta tis tic s M a c - L a y e r H is t o r y P r o m is c u o u s H is to r y C u r r e n t u til iz a ti o n a n d e r r o r s ta ti s tic s o f p r o m i s c u o u s d a t a H i s t o r ic a l u t iliz a ti o n a n d e r r o r s t a tis ti c s o f M a c L a y e r H i s t o r ic a l u t iliz a ti o n a n d e r r o r s t a tis ti c s o f p r o m is c u o u s d a ta t o k e n R in g P S t a t s T a b le t o k e n R in g P S t a t s 2 T a b l e t o k e n R in g M L H i s to r y T a b l e t o k e n R in g P H i s to r y T a b le R i n g S ta tio n S t a t io n s ta ti s ti c s r in g S t a tio n C o n tr o lt a b l e r in g S t a tio n T a b le r in g S t a tio n C o n tr o l2 T a b l e R i n g S ta tio n O r d e r R i n g S ta tio n C o n fig u r a ti o n S o u r c e R o u ti n g O r d e r o f th e s ta tio n s A c tiv e c o n fig u r a tio n o f r in g s t a tio n s U tili z a tio n s ta tis ti c s o f s o u r c e r o u tin g in fo r m a t io n r in g S t a tio n O r d e r T a b le r in g S t a tio n C o n fig C o n tr o lt a b le r in g S t a tio n C o n fig T a b l e s o u r c e R o u tin g S t a t s T a b le s o u r c e R o u tin g S t a t s 2 T a b le Prof. Shervin Shirmohammadi CEG