RMON Configuration Example

In this lesson, we’ll take a look at a simple RMON configuration where we want to receive an SNMP trap when we receive more than 200 unicast packets and also when we receive less than 10 unicast packets. When this occurs we will send an SNMP trap to an SNMP server. I will be using the following topology for this:

R1 R2

Just two routers…I will configure R1 to use RMON and we’ll use R2 to generate traffic so that we can test things.


First, I’ll configure an SNMP server that should receive the SNMP trap, there is none in this example but it doesn’t matter:

R1(config)#snmp-server host MYTRAPS

I’ll use a community called “MYTRAPS”. We can use the “ifInUcastPkts” MIB to track the number of unicast packets, but we need to check the interface number:

R1#show snmp mib ifmib ifindex
FastEthernet0/0: Ifindex = 1
Null0: Ifindex = 4
VoIP-Null0: Ifindex = 3
FastEthernet0/1: Ifindex = 2

I want to monitor the FastEthernet0/0 interface as it is connected to R2. Now we can create an alarm:

R1(config)#rmon alarm 1 ifInUcastPkts.1 10 delta rising-threshold 200 1 falling-threshold 10 2

The command above requires some explanation:

  • First, we create an alarm called “alarm 1”.
  • Secondly, I’m referring to the MIB object ifInUcastPkts.1 where the .1 is the FastEthernet0/0 interface.
  • The “10” means that the sampling interval is 10 seconds.
  • Delta means we use “delta” sampling instead of “absolute” sampling. If you don’t know the difference, take a look at my delta vs absolute lesson.
  • The rising-threshold is set to 200 packets and when this occurs, it will launch “event 1”.
  • The falling-threshold is set to 10 packets and when this occurs, it will launch “event 2”.

With the alarm in place, we can configure the events that should occur when the thresholds are met:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You’ve Ever Spent on Your Cisco Career!
  • Full Access to our 786 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

1616 Sign Ups in the last 30 days

100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!