In this lesson we’ll take a look at a simple RMON configuration where we want to receive a SNMP trap when we receive more than 200 unicast packets and also when we receive less than 10 unicast packets. When this occurs we will send a SNMP trap to a SNMP server. I will be using the following topology for this:

Just two routers…I will configure R1 to use RMON and we’ll use R2 to generate traffic so that we can test things.

Configuration

First i’ll configure a SNMP server that should receive the SNMP trap, there is none in this example but it doesn’t matter:

R1(config)#snmp-server host 192.168.12.254 MYTRAPS

I’ll use a community called “MYTRAPS”. We can use the “ifInUcastPkts” MIB to track the number of unicast packets but we need to check the interface number:

R1#show snmp mib ifmib ifindex
FastEthernet0/0: Ifindex = 1
Null0: Ifindex = 4
VoIP-Null0: Ifindex = 3
FastEthernet0/1: Ifindex = 2

I want to monitor the FastEthernet0/0 interface as its connected to R2. Now we can create an alarm:

R1(config)#rmon alarm 1 ifInUcastPkts.1 10 delta rising-threshold 200 1 falling-threshold 10 2

The command above requires some explanation:

• First we create an alarm called “alarm 1”.
• Secondly I’m refering to MIB object ifInUcastPkts.1 where the .1 is the FastEthernet0/0 interface.
• The “10” means that the sampling interval is 10 seconds.
• Delta means we use “delta” sampling instead of “absolute” sampling. If you don’t know the difference take a look at my delta vs absolute lesson.
• The rising-threshold is set to 200 packets and when this occurs, it will launch “event 1”.
• The falling-threshold is set to 10 packets and when this occurs, it will launch “event 2”.

With the alarm in place we can configure the events that should occur when the thresholds are met: