RMON Configuration Example

In this lesson, we’ll take a look at a simple RMON configuration where we want to receive an SNMP trap when we receive more than 200 unicast packets and also when we receive less than 10 unicast packets. When this occurs we will send an SNMP trap to an SNMP server. I will be using the following topology for this:

Just two routers…I will configure R1 to use RMON and we’ll use R2 to generate traffic so that we can test things.

Configuration

First, I’ll configure an SNMP server that should receive the SNMP trap, there is none in this example but it doesn’t matter:

R1(config)#snmp-server host 192.168.12.254 MYTRAPS

I’ll use a community called “MYTRAPS”. We can use the “ifInUcastPkts” MIB to track the number of unicast packets, but we need to check the interface number:

R1#show snmp mib ifmib ifindex
FastEthernet0/0: Ifindex = 1
Null0: Ifindex = 4
VoIP-Null0: Ifindex = 3
FastEthernet0/1: Ifindex = 2

I want to monitor the FastEthernet0/0 interface as it is connected to R2. Now we can create an alarm:

R1(config)#rmon alarm 1 ifInUcastPkts.1 10 delta rising-threshold 200 1 falling-threshold 10 2

The command above requires some explanation:

• First, we create an alarm called “alarm 1”.
• Secondly, I’m referring to the MIB object ifInUcastPkts.1 where the .1 is the FastEthernet0/0 interface.
• The “10” means that the sampling interval is 10 seconds.
• Delta means we use “delta” sampling instead of “absolute” sampling. If you don’t know the difference, take a look at my delta vs absolute lesson.
• The rising-threshold is set to 200 packets and when this occurs, it will launch “event 1”.
• The falling-threshold is set to 10 packets and when this occurs, it will launch “event 2”.

With the alarm in place, we can configure the events that should occur when the thresholds are met: